CalculateTrustedDeviceRequirement calculates the requirement based on the cluster config and user roles.

HasDeviceTrustExtensions returns true if the certificate's extension names include all the required device-related extensions.

IsSSHDeviceVerified returns true if cert contains all required device extensions.

IsTLSDeviceVerified returns true if ext contains all required device extensions.

VerifySSHUser verifies if the SSH certificate has the required extensions to fulfill the device trust configuration.

VerifyTLSUser verifies if the TLS identity has the required extensions to fulfill the device trust configuration.

ErrTrustedDeviceRequired is returned when access to a resource requires a trusted device.