Validate key attestation

Validates KA material or a stored KA reference against audience, nonce, signer trust, key-storage assurance, user-authentication evidence, and status evidence. This is evidence production for later OID4VCI checks; it does not enforce credential-request processing.