Add UNTESTED warnings to SCP03 and AES-CMAC modules

SCP03 code exists but has not been tested on any hardware.
Only SCP02 is verified (19/19 hardware, 54/54 CI tests).
See GitHub issue #26 for testing roadmap and contribution guide.

Author: Amperstrand

src/keystore/javacard/gp/aes_cmac.py

@@ -1,6 +1,8 @@
 """AES-CMAC (NIST SP 800-38B) implementation.
 
 Pure Python using ucryptolib AES-128-ECB. Used by SCP03 for secure messaging MAC.
+
+WARNING: Not tested on hardware. Only SCP02 is currently verified.
 """
 
 from ucryptolib import aes as _aes

src/keystore/javacard/gp/scp03.py

@@ -4,6 +4,10 @@
 AES-128-CBC for encryption, AES-CMAC for message authentication.
 
 Reference: kaoh/globalplatform/src/crypto.c, OpenJavaCard SCP03Derivation.java
+
+WARNING: This SCP03 implementation has NOT been tested on hardware.
+Only SCP02 is currently verified (19/19 hardware tests, 54/54 CI tests).
+See GitHub issue #26 for SCP03 testing roadmap and how to contribute.
 """
 
 from ucryptolib import aes as _aes