Function certify 

pub(crate) fn certify(
    instance: &WanInstance,
    agent_id: &str,
    channel: &str,
    key: &WanAgentKey,
) -> Option<WanKeyRecord>

This agent key’s directory record, certified by the instance. Channel is the one the agent signs as (AGENTMUX_CHANNEL, local_channel_id), and issued_at is the key’s creation time, so the same key always yields the same record.