@spec confirmation_matches?(String.t(), String.t()) :: boolean()

@spec maybe_put_confirmation(map() | nil, String.t() | nil) :: map() | nil

@spec thumbprint(String.t()) ::
  {:ok, String.t()} | {:error, :invalid_client_certificate}