diff --git a/libnos/BUILD b/libnos/BUILD
index c2c53c4..a03ec8f 100644
--- a/libnos/BUILD
+++ b/libnos/BUILD
@@ -20,3 +20,22 @@
         "//host/generic/libnos_transport",
     ],
 )
+
+cc_library(
+    name = "libnos_debuggable",
+    srcs = [
+        "NuggetClientDebuggable.cpp",
+    ],
+    hdrs = [
+        "include/nos/NuggetClient.h",
+        "include/nos/NuggetClientDebuggable.h",
+    ],
+    includes = [
+        "include",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//host/generic:nos_headers",
+        "//host/generic/libnos",
+    ],
+)
diff --git a/libnos/NuggetClient.cpp b/libnos/NuggetClient.cpp
index 3f4682d..72a9e9f 100644
--- a/libnos/NuggetClient.cpp
+++ b/libnos/NuggetClient.cpp
@@ -15,11 +15,8 @@
  */
 
 #include <nos/NuggetClient.h>
-
 #include <limits>
-
 #include <nos/transport.h>
-
 #include <application.h>
 
 namespace nos {
diff --git a/libnos/NuggetClientDebuggable.cpp b/libnos/NuggetClientDebuggable.cpp
new file mode 100644
index 0000000..5ee86e9
--- /dev/null
+++ b/libnos/NuggetClientDebuggable.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <nos/NuggetClientDebuggable.h>
+#include <limits>
+#include <nos/transport.h>
+#include <application.h>
+
+namespace nos {
+
+NuggetClientDebuggable::NuggetClientDebuggable(request_cb_t req_fn, response_cb_t resp_fn)
+  : request_cb_(req_fn), response_cb_(resp_fn) {}
+
+NuggetClientDebuggable::NuggetClientDebuggable(const std::string& device_name,
+                                               request_cb_t req_fn, response_cb_t resp_fn)
+  : NuggetClient(device_name), request_cb_(req_fn), response_cb_(resp_fn) {}
+
+NuggetClientDebuggable::NuggetClientDebuggable(const char* device_name,
+                                               request_cb_t req_fn, response_cb_t resp_fn)
+  : NuggetClient(device_name), request_cb_(req_fn), response_cb_(resp_fn) {}
+
+uint32_t NuggetClientDebuggable::CallApp(uint32_t appId, uint16_t arg,
+                                         const std::vector<uint8_t>& request,
+                                         std::vector<uint8_t>* response) {
+  if (!open_) {
+    return APP_ERROR_IO;
+  }
+
+  if (request.size() > std::numeric_limits<uint32_t>::max()) {
+    return APP_ERROR_TOO_MUCH;
+  }
+
+  const uint32_t requestSize = request.size();
+  uint32_t replySize = 0;
+  uint8_t* replyData = nullptr;
+
+  if (response != nullptr) {
+    response->resize(response->capacity());
+    replySize = response->size();
+    replyData = response->data();
+  }
+
+  if (request_cb_) {
+    (request_cb_)(request);
+  }
+
+  uint32_t status_code = nos_call_application(&device_, appId, arg,
+                                              request.data(), requestSize,
+                                              replyData, &replySize);
+
+  if (response != nullptr) {
+    response->resize(replySize);
+    if (response_cb_) {
+      (response_cb_)(status_code, *response);
+    }
+  }
+
+  return status_code;
+}
+
+}  // namespace nos
diff --git a/libnos/include/nos/NuggetClient.h b/libnos/include/nos/NuggetClient.h
index f79b168..563f532 100644
--- a/libnos/include/nos/NuggetClient.h
+++ b/libnos/include/nos/NuggetClient.h
@@ -91,7 +91,7 @@
      */
     const std::string& DeviceName() const;
 
-private:
+protected:
     std::string device_name_;
     nos_device device_;
     bool open_;
diff --git a/libnos/include/nos/NuggetClientDebuggable.h b/libnos/include/nos/NuggetClientDebuggable.h
new file mode 100644
index 0000000..507eb15
--- /dev/null
+++ b/libnos/include/nos/NuggetClientDebuggable.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef NOS_NUGGET_CLIENT_DEBUGGABLE_H
+#define NOS_NUGGET_CLIENT_DEBUGGABLE_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include <nos/device.h>
+#include <nos/NuggetClient.h>
+
+namespace nos {
+
+/**
+ * This adds some debug functions around NuggetClient::CallApp()
+ */
+class NuggetClientDebuggable : public NuggetClient {
+public:
+
+  using request_cb_t = std::function<void(const std::vector<uint8_t>&)>;
+  using response_cb_t = std::function<void(uint32_t, const std::vector<uint8_t>&)>;
+
+  /* Need to pass the base constructor params up */
+  NuggetClientDebuggable(request_cb_t req_cb_ = 0, response_cb_t resp_cb_ = 0);
+  NuggetClientDebuggable(const std::string& device_name,
+                         request_cb_t req_cb_ = 0, response_cb_t resp_cb_ = 0);
+  NuggetClientDebuggable(const char* device_name,
+                         request_cb_t req_cb_ = 0, response_cb_t resp_cb_ = 0);
+
+  /* We'll override this */
+  uint32_t CallApp(uint32_t appId, uint16_t arg,
+                   const std::vector<uint8_t>& request,
+                   std::vector<uint8_t>* response) override;
+
+
+private:
+  request_cb_t request_cb_;
+  response_cb_t response_cb_;
+};
+
+} // namespace nos
+
+#endif // NOS_NUGGET_CLIENT_DEBUGGABLE_H
diff --git a/nugget/proto/nugget/app/identity/identity.options b/nugget/proto/nugget/app/identity/identity.options
new file mode 100644
index 0000000..0939e93
--- /dev/null
+++ b/nugget/proto/nugget/app/identity/identity.options
@@ -0,0 +1,2 @@
+nugget.app.identity.ICsetAuthTokenRequest.mac                     max_size:32
+nugget.app.identity.ICsetAuthTokenRequest.verificationTokenMac    max_size:32
diff --git a/nugget/proto/nugget/app/keymaster/keymaster.options b/nugget/proto/nugget/app/keymaster/keymaster.options
index c9105bd..ad3a0a1 100644
--- a/nugget/proto/nugget/app/keymaster/keymaster.options
+++ b/nugget/proto/nugget/app/keymaster/keymaster.options
@@ -13,8 +13,8 @@
 nugget.app.keymaster.GetBootInfoResponse.boot_key max_size:32
 nugget.app.keymaster.GetBootInfoResponse.boot_hash max_size:32
 nugget.app.keymaster.ProvisionPresharedSecretRequest.preshared_secret max_size:32
-nugget.app.keymaster.StartAttestKeyRequest.not_before max_size:13
-nugget.app.keymaster.StartAttestKeyRequest.not_after max_size:13
+nugget.app.keymaster.StartAttestKeyRequest.not_before max_size:15
+nugget.app.keymaster.StartAttestKeyRequest.not_after max_size:15
 nugget.app.keymaster.ProvisionPresharedSecretResponse.digest max_size:32
 nugget.app.keymaster.ProvisionCertificatesRequest.cert_block max_size: 1024
 nugget.app.keymaster.ProvisionCertificatesRequest.digest max_size: 32
\ No newline at end of file
diff --git a/nugget/proto/nugget/app/keymaster/keymaster.proto b/nugget/proto/nugget/app/keymaster/keymaster.proto
index e508c8e..0a11349 100644
--- a/nugget/proto/nugget/app/keymaster/keymaster.proto
+++ b/nugget/proto/nugget/app/keymaster/keymaster.proto
@@ -541,6 +541,7 @@
   bytes not_before = 5;      // strftime('%y%m%d%H%M%SZ') [13 octects]
   bytes not_after = 6;       // strftime('%y%m%d%H%M%SZ') [13 octects]
   uint64 creation_time_ms = 7;      // Rough current time (ms since epoch).
+  bool use_km_attest_key = 8;
 }
 message IdentityStartAttestKeyResponse {
   ErrorCode error_code = 1;