Use three attachments, and test each SHA2 key size, test for bad key size, and ignore order of attachments when verifying attachment data in response