AttestationProof
An authenticated client-to-verifier transport carrying the platform-generated attestation statement.
Signed carries a complete PKCS#10 CSR and proves possession of the attested private key. Hashed carries an unsigned CertificationRequestInfo (TBS CSR) whose contents are bound through the platform attestation nonce, but does not prove possession. The latter does not carry its hash algorithm: the verifier obtains it from the matching AttestationChallenge.