All attestation verification happens client side. We have verifiers in Python [1] and Go [2] (which FFIs to our other SDKs like WASM and Swift). We push all the verification logic to the client so the verification process is entirely transparent and auditable.

[1] https://github.com/tinfoilsh/tinfoil-python [2] https://github.com/tinfoilsh/verifier