fix so error is returned for miss-matched registration challenge

and test it
test non-verifying attestation signature
add test for bad signature in authentication