Merge "KeyMint HAL: clarify ATTEST_KEY is like SIGN"