Yeram inbox receiver for hatogoya.com (spec/inbox.md).
GET /attest?challenge=<32-64 hex> returns a Google-signed attestation token whose nonces bind
the fleet's key set (tls-, dkim-, send-) and this boot's key (sig-<multikey>) to the image.