Security: verifyTeeIntegrity does not authenticate the attested endpoint

[w-woloszyn]

Affects:

• ts/web3js/src/access-control/verify.ts
• ts/kit/src/access-control/verify.ts

Same issue in both files.

The verifier advertises an expected validator identity in the docstring, but the actual public API is just verifyTeeIntegrity(rpcUrl: string).

And the trust decision is still based on server-returned material:

• @param validatorIdentity - The expected identity of the validator
• const pk = Buffer.from(response.pubkey, "base64");
• nacl.sign.detached.verify(challengeBytes, sig, pk);
• reportData.subarray(0, 32).equals(hclVarDataSha256)

So this can return true without authenticating the specific PER endpoint / validator / code image / attested key the client intended to trust.

That is quote-material validation, not endpoint authentication via remote attestation.