DeviceAuthenticationRotationStatus
data class DeviceAuthenticationRotationStatus(val authEpoch: Long, val authKeyInstalledAt: Instant, val evaluatedAt: Instant, val pendingRotation: Boolean, val pendingRecovery: Boolean)
This device's server authentication state, for display, logging and policy decisions. Contains no key material.
authEpoch and authKeyInstalledAt come from the server's registration (the signed GET …/registration): the server time the registered key was installed at by first registration, recovery or rotation. age is evaluatedAt (the client's clock) minus authKeyInstalledAt, never negative: a client clock behind the server time gives age zero. pendingRotation and pendingRecovery tell whether a routine rotation or a device recovery key is waiting locally.