Additional notes/updates here:

• Turns out, after some investigation, the AuthHelper usage is really leftover code, that was not actually doing anything; HttpDownloader already adds the auth header for us 😅 the Remove AuthHelper from attestation lookups ThePHPF/attestation#11 library was also updated (the code was moved over from PIE originally)
• The format which Composer stores repos was changed (see Change config command to allow empty name when adding new repositories composer/composer#12388)
• Also does some phpstan updates/enhancement with webmozart extension which eliminated a few baseline issues

Thanks @rtm-ctrlz !