anchor.diff:    optional DOMString value;
   }
   ----
  -
  +The key field contains the textual representation of the OID of the extension
  +to match against. The value field contains the matching value when compared to
  +the extensions OctetString value when interpreted as an ASCII string. If the
  +value field is missing, any value will be accepted, as long as the certificate
  +has the extension with the given key.
  
positive.code: ----
  dictionary Selector {
    DOMString type;
    optional any parameters;
  }
  ----
  
  
negative.code:   +fingerprint+
  
  Parameters type::
  [source, javascript]
  ----
  dictionary FingerprintParameters {
    DOMString[] fingerprints;
  }
  ----
  The fingerprints field contains hex values of SHA1 fingerprints of attestation
  certificates to match against.
  
  ===== x509Extension
  Match certificates by their extensions.
  