verifyCombined
Verifies an App Attestation in conjunction with an assertion for some client data.
First, it verifies that the attestation was created over challenge. It then verifies that the same attested key signed referenceClientData in its first assertion. This binds referenceClientData to the fresh attestation, so referenceClientData does not itself need to contain challenge.
App Attest assertions do not contain the client data. referenceClientData must be the exact, unhashed bytes whose SHA-256 digest the client passed to generateAssertion. The caller must obtain challenge from trusted server-side state and enforce its expiry and single use.
Parameters
the AppAttest attestation object to verify
the assertion data created on the device.
the exact client data cryptographically bound to assertionFromDevice
the one-time server challenge used to create attestationObject