NO_AUTH_REQUIRED should be added to authorizations when not explicitly disabled (!= false), matching AOSP default behavior. The != null check from PR157 drops the tag for keys where noAuthRequired was parsed as null (e.g. persisted keys), creating an attestation/authorization mismatch that detectors can spot. Also restores CALLER_NONCE in softwareEnforced attestation list.