Who can generate an attestation for what (are third party attestations allow)? Is the source of the attestation considered in compliance, and if so what is its impact?

[ashleygwilliams]