I had a conceptual doubt over the certificates being used in this attested TLS setup. According to this draft that islet/ratls seems to follow: https://datatracker.ietf.org/doc/draft-fossati-tls-attestation/ and the README, the TLS certificates are self-signed. In that case, what is the need for the root-ca.crt? Is there any root CA that signs the certificates? Then how can it be called a self-signed certificate? What am I missing here?