# SecureStorage

This adapter stores the TV token, certificate pin, and pairing state in the
iPhone Keychain under an opaque television UUID. It is injected through
`KeychainClient` for deterministic tests and conforms to the frozen
`TVAuthorizationStore` protocol from `TVTransport`.

The candidate accessibility is `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`:
it is the narrowest device-only option that can support a phone-lock relay after
the first unlock. It is unavailable before the first unlock after reboot and has
not yet been validated on a signed iPhone. The stronger
`WhenUnlockedThisDeviceOnly` option remains available for a deployment that
does not require locked-phone relay.

Certificate trust is fail-closed. A self-signed certificate is accepted only
after an explicit user approval supplied to `approveCertificate`; the exact
SHA-256 leaf fingerprint is then pinned to that opaque TV ID. A changed
fingerprint returns `requiresReapproval` and is never silently accepted. The
stored source records that first-use fingerprinting came from an unauthenticated
connection, so it is not presented as proof of TV identity.

`forgetTelevision` removes the complete Keychain record. `deleteToken` revokes
pairing while preserving the trust pin; `deleteTrust` removes trust material.
Neither tokens nor trust records are sent to WatchConnectivity or cloud storage.