Local Attestation between untrusted code and enclave

Any [examples](https://software.intel.com/content/www/us/en/develop/documentation/sgx-developer-guide/top/attestation/local-intraplatform-attestation.html) that I've seen for local attestation talks about creating a protected channel between two enclaves.

I'm instead interested in giving an untrusted application confidence that it's talking to the expected enclave running on the expected hardware.

---
So,

Suppose we have `Enclave A` and `Untrusted Application` (running on same CPU).

How can I generate a `REPORT` on `Enclave A` such that the `Untrusted Application` can verify that the expected CPU bound key signed an unforgeable `MRENCLAVE` value?

Can I assume that the `Untrusted Application` knows the public key of the CPU bound Intel SGX key?
If so, how can I get it?
Or is this functionality only available to other enclaves running on the same CPU? Seems like there's no reason this can't happen in the `Untrusted Application` as long as `Enclave A` doesn't expect to be talking to another enclave.