Remove orphaned native logging that nothing reached:
- The /sdcard/Download zip dump (NativeCertGen.dump and the dumpLogs
JNI, dump_logs_inner, dump.rs, pub mod dump), superseded by the
diag.sh export.
- The verbose-marker helpers (sysfs.rs, pub mod sysfs); the manual
.verbose toggle still works via mod.rs::init's inline check.
Drop the now-unused direct deps zip and libc and the orphaned jstring
import. cargo ndk build is warning-clean.
DuckDetector flagged two issues:
1. Oversized challenge accepted, 256-byte attestation challenge should
return INVALID_INPUT_LENGTH (-21) like real KeyMint. Added early check
in handleGenerateKey before any path decision.
2. Issuer/subject chain mismatch, rcgen's HashMap loses DN attribute
ordering and converts PrintableString to UTF8String, producing
different DER bytes. Replaced rcgen with manual DER assembly that
injects raw keybox issuer_dn_der bytes directly.
Verified on device: TX_ID 315 rejects 256-byte challenge, TX_ID 501
generates valid 4-cert chain with correct issuer linkage.
Enginex0