Before you try anything: this page runs the calendar's crypto in your own browser and fires a battery of forged requests at the live server. Every forgery should be rejected. Every green line below is something you would have to defeat.
Client tests run automatically. The server tests register a throwaway key that never gets enrolled (no entry on the ledger; it expires after 15 min).