keymaster: Add command to clear attestation cert chain
Instead of automatically clearing the attestation certificate chain
every time it fills up. Add a command to clear the chain and return an
error if the chain is too long. This avoid silent failures if someone
tries to provision a chain longer than supported, and it allows more
predicatable reprovisioning where the client does not need to know how
many certificates have already been provisioned.
Bug: 154033394
Change-Id: I771f59f5d7db1839d719b11a45c0d3bbe05d5e5c
5 files changed
