Also validate revocation reasons in attestation

[phavekes]

No description provided.

[MKodde]

Nice addition. I now started thinking. Would not the latest report be the current one? In other words, should we not only evaluate the latest and greatest? I think I'm onto something here.

See https://fidoalliance.org/specs/mds/fido-metadata-service-v3.0-ps-20210518.html#statusreport-dictionary

We can use the effectiveDate to check if the report is to be considered.
Any remaining reports can be evaluated with the current algo

[phavekes]

Nice addition. I now started thinking. Would not the latest report be the current one? In other words, should we not only evaluate the latest and greatest? I think I'm onto something here.

See https://fidoalliance.org/specs/mds/fido-metadata-service-v3.0-ps-20210518.html#statusreport-dictionary

We can use the effectiveDate to check if the report is to be considered. Any remaining reports can be evaluated with the current algo

"If no date is given, the status is assumed to be effective while present."

That complicates things. What if one report has an effectivedate, and another one hasn't?
I don't think effectiveDate adds to the security of the evaluation.

We could use the effectiveDate in case of ATTESTATION_KEY_COMPROMISE to delete any enrollments past this date, but that's not something for this code.