Function build_attestation 

pub fn build_attestation(
    op_sk: &[u8],
    fingerprint: &[u8; 32],
    session_did: &str,
) -> Result<(String, String), CertError>

Build the attestation: op_sk signs the canonical message over (fingerprint, session_did). Returns (machine_fingerprint_b64, signature_b64) ready to drop into the card’s same_machine_attestation.