spec: https://wicg.github.io/trust-token-api/