System 3 — device needing non-repudiation (T9–T12)

[DavidCozens]

T9 mutual TLS (per-device cert/key); T10 keyed HMAC at-rest policy; T11 OriginSd + sysUpTime; T12 discard policy + store-full response. The maximal offering — SL3 or higher. Sub-issue of #1.