MAC_PREFERRED

The holder key agrees a key with the reader's ephemeral key and the response carries a MAC (deviceMac). The reader can check it but can't prove to anyone else that this device took part; the issuer-signed elements stay provable. A holder key that can't agree keys signs instead.