Remind clients to verify returned module info

Bug: 369375199
Test: n/a
Change-Id: Ia7d060a728e1e007844251fb7bfc81bdd91eba2f

keystore2/aidl/android/system/keystore2/IKeystoreService.aidl

diff --git a/keystore2/aidl/android/system/keystore2/IKeystoreService.aidl b/keystore2/aidl/android/system/keystore2/IKeystoreService.aidl
index 666985c..886047d 100644
--- a/keystore2/aidl/android/system/keystore2/IKeystoreService.aidl
+++ b/keystore2/aidl/android/system/keystore2/IKeystoreService.aidl
@@ -255,7 +255,9 @@
      *
      * o Tag::MODULE_HASH: returns the DER-encoded structure corresponding to the `Modules` schema
      *   described in the KeyMint HAL's KeyCreationResult.aidl. The SHA-256 hash of this encoded
-     *   structure is what's included with the tag in attestations.
+     *   structure is what's included with the tag in attestations. To ensure the returned encoded
+     *   structure is the one attested to, clients should verify its SHA-256 hash matches the one
+     *   in the attestation. Note that the returned structure can vary between boots.
      *
      * ## Error conditions
      * `ResponseCode::INVALID_ARGUMENT` if `tag` is not specified in the list above.