# forward the client pubkey: this allows us to omit authid as
# the router can identify us with the pubkey already
'pubkey': _public_key,
# for authenticating the router, this challenge will need to be signed
# by the router and send back in AUTHENTICATE for client to verify.
# A string with a hex encoded 32 bytes random value.
'challenge': None,
# https://tools.ietf.org/html/rfc5929
'channel_binding': 'tls-unique'
'channel_id': ...
# a public key the router should provide a trustchain for its public key.
# the trustroot can eg be hard-coded in the client, or come from a command
# line option.
'trustroot': None,
'certificate': ...
