attestation

Device attestation (using clientId bytes as nonce).

This is only set if this is the first time the client is authenticating.