Expose read-only attestation authority header (#3)

Add honest deployment-source attestation (#2)

Route receipt verification through canonical A11OY API (#1)