@cft I only received your posts just now, but we independently settled (mostly) on using a strict subset of CBOR. I'll interpret that as a good sign.
I was unaware of COSE, it is nice to see an "official" standard for this, although it seems like not much of it applies to ssb.