educational
Read the scope before the signature.
Three questions to ask of a certificate: what was checked, is the record intact, and does it still apply?
What did the certificate establish?
Start with the exact subject revision, configuration and rule versions. Read the method, explored cases, budget, assumptions and exclusions. No violation observed in bounded cases is not a universal safety claim.
A useful certificate can report a failure or an incomplete result. Check whether each rule was exercised and whether the evidence supports the claimed outcome. Distinguish an attempted action from a confirmed external effect.
What is protected?
A digest identifies bytes. A signature can authenticate a message under a key. A retained anchor can tie a portion of a ledger to a checkpoint you trust. None of these makes the underlying observation true or guarantees that every action was recorded.
The existing evidence-pack verifier checks ledger integrity relative to retained anchors. It ignores derived action and coverage summaries. A certificate manifest needs its own supported protection profile; a pretty rendering is not automatically signed because it sits beside a ledger.
Does it still apply?
Check the subject, policy, configuration and assumptions against the system you are considering. Look for later fixes, rechecks, invalidations, withdrawals and key-status records.
Offline verification can establish historical integrity under its supplied inputs. Without a fresh trusted status snapshot, current applicability or non-revocation may remain unknown. Keep the snapshot date and age with your decision.
Sources & corrections
Corrections: none recorded.
Related issued certificates: none. Examples are educational.