Support Cryptosign trustroot/certificate

• pubkey
• challenge
• channel_binding
• channel_id
• trustroot https://github.com/crossbario/crossbar/blob/09eaf37ce0dfc58e97ed8e0af428bea28dea61cc/crossbar/worker/rlink.py#L550
• certificate

# forward the client pubkey: this allows us to omit authid as
# the router can identify us with the pubkey already
'pubkey': _public_key,

# for authenticating the router, this challenge will need to be signed
# by the router and send back in AUTHENTICATE for client to verify.
# A string with a hex encoded 32 bytes random value.
'challenge': None,

# https://tools.ietf.org/html/rfc5929
'channel_binding': 'tls-unique'
'channel_id': ...

# a public key the router should provide a trustchain for its public key.
# the trustroot can eg be hard-coded in the client, or come from a command
# line option.
'trustroot': None,
'certificate': ...

Start by reading the referenced crossbar/worker/rlink.py location and the Cryptosign authentication flow in autobahn-python. Trace how pubkey, challenge, channel binding, and channel ID are exchanged, then determine the protocol and verification requirements for trustroot and certificate support. Done means the exchange supports both fields with appropriate verification and coverage for the new behavior.