Issue with DCAppAttestService for offloaded app

Hi,

When calling generateAssertion on DCAppAttestService.shared, it gives invalidKey error when there was an update for an offloaded app.

The offloading and reinstall always works fine if it is the same version on app store that was offloaded from device, but if there is an update and the app tries to reuse the keyID from previous installation for generateAssertion, attestation service rejects the key with error code 3 (invalid key) for a significant portion of our user. In our internal testing it failed for more than a third of the update attempts.

STEPS TO REPRODUCE:

1. install v1 from app store
2. generate key using DCAppAttestService.shared.generateKey
3. Attest this key using DCAppAttestService.shared.attestKey
4. Send the attestation objection to our server and verify with apple servers
5. Generate assertions for network calls to backend using DCAppAttestService.shared.generateAssertion with keyID from step 2
6. Device offloads the app (manually triggered by user, or automatically by iOS)
7. A new version v2 is published to App Store
8. Use tries to open the app
9. Latest version is download from the App Store
10. App tries to use the keyID from step 2 to generate assertions
11. DCAppAttestService throws invalidKey error (Error Domain=com.apple.devicecheck.error Code=3)

Step 7 is critical here, if there is no new version of the app, the reinstalled v1 can reuse the key from step 2 without any issues

Is this behaviour expected? Is there any way we can make sure the key is preserved between offloaded app updates?

Thanks