[timweri]

• Parse attestation root chains only once. For each leaf attestation, we only verify 1 signature to make sure the leaf attestation chains up to the already verified chains.
• Add attestations from an actual Yubikey on 5.8.0 to tests.

[Copilot]

Copilot review overview

🟢 Approval recommended

The cached signer lookup preserves verification behavior and the new B2 chains are covered by representative tests.

Review effort: Balanced
Findings: None

What changed in this PR

Optimizes Yubico attestation verification by caching trusted signer certificates and selecting them by issuer.

Changes:

• Cache parsed PIV and FIDO signers with OnceLock.
• Verify intermediates directly against matched signers.
• Add YubiKey 5.8.0 B2-chain coverage.

File	Description
src/​yubikey/​verification.rs	Optimizes PIV chain verification.
src/​fido/​verification.rs	Optimizes FIDO chain verification.
tests/​yubikey-lite.rs	Adds PIV 5.8.0 coverage.
tests/​fido-lite.rs	Adds FIDO 5.8.0 coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[timweri]

@obelisk The verify functions don't work in the const block.

error[E0015]: cannot call non-const function `verify_certificate_chain` in constants

We can put the validation in build.rs. But I think OnceLock is good enough for now.