Can attestations be rate-limited or is that the timing side-channel you are talking about?