This adapter stores the TV token, certificate pin, and pairing state in the iPhone Keychain under an opaque television UUID. It is injected through KeychainClient for deterministic tests and conforms to the frozen TVAuthorizationStore protocol from TVTransport.

The candidate accessibility is kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly: it is the narrowest device-only option that can support a phone-lock relay after the first unlock. It is unavailable before the first unlock after reboot and has not yet been validated on a signed iPhone. The stronger WhenUnlockedThisDeviceOnly option remains available for a deployment that does not require locked-phone relay.

Certificate trust is fail-closed. A self-signed certificate is accepted only after an explicit user approval supplied to approveCertificate; the exact SHA-256 leaf fingerprint is then pinned to that opaque TV ID. A changed fingerprint returns requiresReapproval and is never silently accepted. The stored source records that first-use fingerprinting came from an unauthenticated connection, so it is not presented as proof of TV identity.

forgetTelevision removes the complete Keychain record. deleteToken revokes pairing while preserving the trust pin; deleteTrust removes trust material. Neither tokens nor trust records are sent to WatchConnectivity or cloud storage.