Attestation key signature mechanism

This describes the mechanism whereby the certificate-holder can attest to which third-party certifications they want to be redistributed.

It is likely not in charter as part of the crypto-refresh, but it has nevertheless seen some adoption.