validate
suspend fun validate(httpRequest: RequestInfo?, clientId: String?, validatedClientKey: JsonWebKey?, policy: ValidationPolicy): ClientAttestationValidation(source)
Validates the client attestation and its proof of possession in httpRequest under policy, see ClientAttestationValidator.validate and ClientAttestationChecks: with a client attestation PoP JWT (draft-ietf-oauth-attestation-based-client-auth-10, 5.2), or, if DpopCombined is accepted, with the DPoP proof whose key is validatedClientKey (6). The challenge is consumed only if the client attestation is accepted, so it is not usable again. The clock is read once, all checks use that time.
Fails if httpRequest contains no client attestation, or the challenge has been used concurrently.