Where is what executed at? Aattestation and assertion

[GildedHonour]

In Readme it's unclear where, on the server or on the client, each peace of code is executed.

Apart from this:

When to use "Verify an attestation" and when "Verify an assertion"? Do they always must be used together? In what sequence? Why not use only one of them? No mention is there in the Readme either.