AOSP ta/src/keys.rs:451-478 requires self-signed leaf (depth 1) when no attestation challenge is provided. Both Kotlin and Rust paths now return subject==issuer, signed by generated key, no attestation extension. Adds cert chain trace logging in debug builds.