Add guidance on how & how not to verify attestations

[Tom Hennen]

Probably

1. Not all fields necessary need to be verified (some are just for 'debugging' information)
2. Reconstruction is not viable, clients won't know the values of all fields.

Anything else?

[Tom Hennen]

It occurs to me that the Parsing rules would seem to do this already?

Independent reconstruction would seem to be incompatible with the requirement to ignore unrecognized fields?

[Marcela Melara]

This may or may not be related to #290 .