Enginex0
bb28a8d30c
Sliding window limits each UID to 2 hardware generateKey calls per 30s burst window with max 2 concurrent. Overflow falls back to software cert generation. importKey post-hook retains patched chains instead of full eviction, preventing detectors from using generate-then-import to bypass attestation patching. getKeyEntry serves retained chains for imported keys that overwrote attested aliases.