Should we double-check attestation flags when serializing?

Regarding these TODOs:

The security device sends us a CTAP-response that contains both the flags (AT: response contains credential data, ED: response contains extensions) and the actual data. We deserialize that into a Rust struct.
We are then serializing it again into a different format, the one webauthn requires. The way we currently do it, is to just serialize the flags as given and check if our Rust-struct contains either credential data or extensions, and serialize them, too.

That means, we trust the device to set the correct flags, instead of double-checking them (== "is the AT-flag really set, if we have credential data?"). But when we start double-checking everything the device sends us, there will be a lot of sanity check code necessary.
I therefore think we can "just trust" the device here.

Start by reviewing the TODOs and changes referenced in pull request #230, then trace how CTAP response flags and credential or extension data are deserialized and serialized into the WebAuthn format. Determine whether consistency checks are required or whether trusting the security device is intentional; done should include a documented decision and any agreed validation work.