Default: verify on-device using the bundled Romanian MAI cert chain.
Return raw proof to the caller — no on-device verification.