PREFERRED

In StrongBox when the device makes the key there, else the TEE. Any StrongBox failure turns to the TEE, with a warning logged (tag OID4VCWallet); securityLevel says where a key is. Creating a key tries at most every storage, purpose set and digest set (8 generations for a holder key that agrees keys), each retried up to 3 times where Keystore reports its failure transient.