Trust but sometimes verify: Regulatory enforcement in attestation‐based immigration programs