MVP note: this creates a human-review attestation record. MFA/passkey and message fingerprinting can be added later.