Builds v3 leaf certificate with attestation extension and KeyUsage, signs with keybox private key via rcgen 0.13.2. Assembles full chain (leaf + keybox intermediates + root). Supports EC and RSA keybox signing keys. Uses rcgen's signed_by() with a synthesized issuer Certificate, no manual DER fallback needed.