Function protector_matches 

pub fn protector_matches(
    tee: &dyn TeeCall,
    config: &AttestationVmConfig,
    protector_bytes: &[u8],
    dek: &[u8; 32],
) -> Result<bool, Error>

Check whether the stored protector authenticates and unseals to the active DEK on the current hardware, using its stored policy and SVN.

Returns Ok(false) for malformed, incompatible, policy-mismatched, or unauthenticated protectors, and for a different DEK. Hardware derivation and crypto operational failures return Err, not a mismatch. An unavailable source SVN is a derivation error: the caller may explicitly retry by creating a protector with the destination’s current SVN. No derived keys are cached. This stateless helper does not obtain a report or enforce a runtime TCB floor; runtime candidate verification must use RuntimeTcbFloor::verify_protector.