Path suffix users/{id}/wallet/ethereum/secp256k1/v{epoch}.
65-byte uncompressed 0x04..; publicKeyToAddress(publicKey) == address.
20-byte dstack app_id.
32-byte compose hash.
OptionalosOmitted when the OS does not expose its image hash.
Must equal ENCLAVE_WALLET_PURPOSE.
[appRoot over link 0, kmsRoot over link 1]; see appRootPreimage and kmsIssuedPreimage.
Raw TDX quote with report_data keccak256(userPsId || address); not parsed.
keccak256 of the uncompressed KMS root public key.
Attested identity evidence returned by the enclave agent.