[Caliptra 2.0] Questions about debug unlock design

[jhand2]

I was reading through the ROM documentation for debug unlock and had a few questions:

1. The ROM documentation seems to be missing some higher level details like how unlock impacts attestation, how it interacts with the debug_en wire from 1.0, what things it unlocks, etc. Is there a high level document somewhere with these kind of details? If not, we should write something.
2. Can we write up the expected use-cases of this design? Is it expected to be usable in a datacenter environment or is it primarily for RMA flows?
3. Do we have any recommendations on whether MANUF_DEBUG_UNLOCK_TOKEN should be chip-specific or a class secret? Or are we leaving that up the the integrator?
4. Are we requiring debug unlock tokens to be supplied to ROM? Or do we expect this functionality to also work via RT firmware?