Merge "Optionally (dis)allow degenerate DICE chains in verifyCsr" into main