From 1c5c8a4e148a60a12e16d2758e229f01ac7fae96 Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Thu, 12 Nov 2026 09:45:31 -0500
Subject: [PATCH] Add craft-pkcs7: DER, X.509, CMS SignedData, PKCS #12, RFC
 3161 and revocation from PdfCraft

* Add craft-pkcs7: DER, X.509, CMS SignedData, PKCS #12, RFC 3161 and revocation from PdfCraft

Moved from PdfCraft's crates/sign at 1d7a9f9f: der, x509, cms, pkcs12, timestamp,
revocation, keys, rsa_pad and ec512, with their unit tests, the integration tests
that need no PDF, and the test keys.

x509 no longer returns PdfCraft's worded sentences: signing_problem gives a
SigningProblem and build_chain_noted a Refused (reason and the two certificates).
The checks behind them are unchanged. Error is SignError without its PDF variants.

* craft-pkcs7: write the certificate serial verbatim in SignerInfo and ESSCertIDv2

A serial with its high bit set and no leading zero was written with one added, so
the signer identifier and the signing-certificate attribute named a different
number than the certificate has.

Ported from storytold/pdfcraft#6868. The test uses a certificate that really has
such a serial and also checks that the signer's certificate is found.

* craft-pkcs7: note why RIPEMD-160 is supported

---------

Co-authored-by: jonathanwxh-cell <jonathanwxh@gmail.com>
---
 ATTRIBUTION.md                           |   1 +
 Cargo.lock                               | 643 +++++++++++++++---
 Cargo.toml                               |   1 +
 README.md                                |   4 +
 crates/pkcs7/Cargo.toml                  |  53 ++
 crates/pkcs7/README.md                   |  44 ++
 crates/pkcs7/src/cms.rs                  | 595 +++++++++++++++++
 crates/pkcs7/src/der.rs                  | 663 ++++++++++++++++++
 crates/pkcs7/src/ec512.rs                | 180 +++++
 crates/pkcs7/src/keys.rs                 | 767 +++++++++++++++++++++
 crates/pkcs7/src/lib.rs                  |  56 ++
 crates/pkcs7/src/pkcs12.rs               | 561 ++++++++++++++++
 crates/pkcs7/src/revocation.rs           | 309 +++++++++
 crates/pkcs7/src/rsa_pad.rs              | 147 ++++
 crates/pkcs7/src/timestamp.rs            | 253 +++++++
 crates/pkcs7/src/x509.rs                 | 704 ++++++++++++++++++++
 crates/pkcs7/tests/data/README.md        |  62 ++
 crates/pkcs7/tests/data/ca.crt.pem       |  12 +
 crates/pkcs7/tests/data/chain-legacy.p12 | Bin 0 -> 2878 bytes
 crates/pkcs7/tests/data/chain.p12        | Bin 0 -> 3044 bytes
 crates/pkcs7/tests/data/ec-legacy.p12    | Bin 0 -> 1047 bytes
 crates/pkcs7/tests/data/ec-p256.p12      | Bin 0 -> 1112 bytes
 crates/pkcs7/tests/data/ec-p384.p12      | Bin 0 -> 1162 bytes
 crates/pkcs7/tests/data/rsa-aes.p12      | Bin 0 -> 2714 bytes
 crates/pkcs7/tests/data/rsa-legacy.p12   | Bin 0 -> 2556 bytes
 crates/pkcs7/tests/data/rsa.crt.pem      |  20 +
 crates/pkcs7/tests/it/algorithms.rs      | 140 ++++
 crates/pkcs7/tests/it/ber.rs             |  76 +++
 crates/pkcs7/tests/it/chain.rs           | 312 +++++++++
 crates/pkcs7/tests/it/cms.rs             | 130 ++++
 crates/pkcs7/tests/it/crypto.rs          | 812 +++++++++++++++++++++++
 crates/pkcs7/tests/it/main.rs            |   8 +
 crates/pkcs7/tests/it/store_keys.rs      |  89 +++
 33 files changed, 6554 insertions(+), 88 deletions(-)
 create mode 100644 crates/pkcs7/Cargo.toml
 create mode 100644 crates/pkcs7/README.md
 create mode 100644 crates/pkcs7/src/cms.rs
 create mode 100644 crates/pkcs7/src/der.rs
 create mode 100644 crates/pkcs7/src/ec512.rs
 create mode 100644 crates/pkcs7/src/keys.rs
 create mode 100644 crates/pkcs7/src/lib.rs
 create mode 100644 crates/pkcs7/src/pkcs12.rs
 create mode 100644 crates/pkcs7/src/revocation.rs
 create mode 100644 crates/pkcs7/src/rsa_pad.rs
 create mode 100644 crates/pkcs7/src/timestamp.rs
 create mode 100644 crates/pkcs7/src/x509.rs
 create mode 100644 crates/pkcs7/tests/data/README.md
 create mode 100644 crates/pkcs7/tests/data/ca.crt.pem
 create mode 100644 crates/pkcs7/tests/data/chain-legacy.p12
 create mode 100644 crates/pkcs7/tests/data/chain.p12
 create mode 100644 crates/pkcs7/tests/data/ec-legacy.p12
 create mode 100644 crates/pkcs7/tests/data/ec-p256.p12
 create mode 100644 crates/pkcs7/tests/data/ec-p384.p12
 create mode 100644 crates/pkcs7/tests/data/rsa-aes.p12
 create mode 100644 crates/pkcs7/tests/data/rsa-legacy.p12
 create mode 100644 crates/pkcs7/tests/data/rsa.crt.pem
 create mode 100644 crates/pkcs7/tests/it/algorithms.rs
 create mode 100644 crates/pkcs7/tests/it/ber.rs
 create mode 100644 crates/pkcs7/tests/it/chain.rs
 create mode 100644 crates/pkcs7/tests/it/cms.rs
 create mode 100644 crates/pkcs7/tests/it/crypto.rs
 create mode 100644 crates/pkcs7/tests/it/main.rs
 create mode 100644 crates/pkcs7/tests/it/store_keys.rs

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 27e9ca01b..965b348e4 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -85,6 +85,7 @@ and the exact transfer revision are recorded in each vendored crate's SOURCE.jso
 | `crates/raster-codecs/src/xpm/x11_colors.rs` | X.Org Foundation and X11 contributors (X11 `rgb.txt` colour names and values, normalised into a lookup table) | <https://cgit.freedesktop.org/xorg/app/rgb/tree/rgb.txt>, via [PhotoCraft `crates/codecs`](https://github.com/storytold/photocraft/tree/63b641b55e54bf8f5c83efd977fdb16a2c255431/crates/codecs/src/codecs/xpm) | MIT (X.Org app/rgb) |
 | `crates/psd/tests/fixtures/atn/*.atn` (seven synthetic action sets, encoded field by field; `crates/psd/tests/fixtures/atn/README.md`) | PhotoCraft contributors | [PhotoCraft `crates/psd/tests/fixtures/atn`](https://github.com/storytold/photocraft/tree/63b641b55e54bf8f5c83efd977fdb16a2c255431/crates/psd/tests/fixtures/atn) | MIT OR Apache-2.0 |
 | `crates/lottie/tests/fixtures/` | EffectCraft contributors (original work: four hand-written Lottie JSON documents, written from the public Lottie format description; not exported from any Adobe product or third-party file) | [EffectCraft `crates/lottie/tests/fixtures`](https://github.com/storytold/effectcraft/tree/e18f48fb/crates/lottie/tests/fixtures) | MIT OR Apache-2.0 |
+| `crates/pkcs7/tests/data/` | PdfCraft contributors (original work: throw-away test keys and certificates made with OpenSSL 3 for these tests, as seven PKCS #12 files with the password `test` and two PEM certificates; they protect nothing; commands in `crates/pkcs7/tests/data/README.md`) | [PdfCraft `crates/sign/tests/data`](https://github.com/storytold/pdfcraft/tree/1d7a9f9f/crates/sign/tests/data) | MIT OR Apache-2.0 |
 | `crates/affinity/tests/support/corpus.tsv`, `crates/affinity/tests/support/affinity3-signatures.txt` (manifest and measured signatures only; the 51 documents are not bundled, `scripts/fetch-affinity-corpus.sh` downloads them outside the checkout) | The authors of each document: samuel-etver (vector-art), Seth A. Robinson (Patchy fixtures), Nick Beeuwsaert (AFDesignLoad), Jeremy Cantu (Branding), eviltwo (AssetStoreTemplate), Square (leakcanary) | each file's pinned upstream URL and SHA-256 in the manifest; list carried over from [VectorCraft `xtask/src/affinity_corpus.rs`](https://github.com/storytold/vectorcraft/blob/6e873b806c9d5b3f2b55f651df57bd97933b579a/xtask/src/affinity_corpus.rs) | CC0-1.0, MIT or Apache-2.0 (per file, in the manifest) |
 | `crates/raw/docs/coverage/adobe-cameras.tsv` | Facts (maker, model, extension, profile, minimum Camera Raw version) parsed by LightCraft contributors from Adobe's published list | [Adobe Camera Raw supported cameras](https://helpx.adobe.com/camera-raw/desktop/dng-and-file-formats/camera-raw-plug-supported-cameras.html), Wayback capture 20261003133011; moved from [LightCraft `docs/raw`](https://github.com/storytold/lightcraft/tree/5ff567a4a2e067bef1b6bce152c11e7f727ccbaf/docs/raw) | Facts, not copyrightable expression; the file is MIT OR Apache-2.0 |
 | `crates/raw/docs/coverage/{coverage,coverage-sweep,evidence,usage-weights}.tsv`, `coverage.py` | LightCraft contributors | [LightCraft `docs/raw`](https://github.com/storytold/lightcraft/tree/5ff567a4a2e067bef1b6bce152c11e7f727ccbaf/docs/raw) | MIT OR Apache-2.0 |
diff --git a/Cargo.lock b/Cargo.lock
index 285897052..2dac6e3ba 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -396,6 +396,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -548,6 +554,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.5.1"
@@ -613,6 +628,30 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "bp256"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46f98c2d9e8e0796b24f84b7ae14159b91ae6ae4b85f74f7655a678a56ad5e1e"
+dependencies = [
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.3",
+ "primefield",
+ "primeorder 0.14.0",
+]
+
+[[package]]
+name = "bp384"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc61f3a96b44a33fbb971e9917b81f4207d6dae9a6b0715845c785a48e73d9c2"
+dependencies = [
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.3",
+ "primefield",
+ "primeorder 0.14.0",
+]
+
 [[package]]
 name = "brotli"
 version = "8.0.4"
@@ -765,6 +804,15 @@ dependencies = [
  "cipher 0.4.4",
 ]
 
+[[package]]
+name = "cbc"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
+dependencies = [
+ "cipher 0.5.2",
+]
+
 [[package]]
 name = "cc"
 version = "1.6.0"
@@ -907,8 +955,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "961b955a666e25ee5a1091d219128d6e6401e3dab84efb1a2bf6b4035d797b39"
 dependencies = [
  "crmf",
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
  "x509-cert",
 ]
 
@@ -919,8 +967,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b77c319abfd5219629c45c34c89ba945ed3c5e49fcde9d16b6c3885f118a730"
 dependencies = [
  "const-oid 0.9.6",
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
  "x509-cert",
 ]
 
@@ -1806,14 +1854,14 @@ dependencies = [
 name = "craft-openpgp"
 version = "0.1.0"
 dependencies = [
- "ed25519-dalek",
+ "ed25519-dalek 2.2.0",
  "pgp",
  "proptest",
  "rand 0.8.8",
- "rsa",
+ "rsa 0.9.10",
  "sha1 0.10.7",
  "sha2 0.10.9",
- "sha3",
+ "sha3 0.10.9",
  "thiserror 2.0.21",
 ]
 
@@ -1884,6 +1932,37 @@ dependencies = [
  "zip",
 ]
 
+[[package]]
+name = "craft-pkcs7"
+version = "0.1.0"
+dependencies = [
+ "aes 0.9.4",
+ "aws-lc-rs",
+ "base64 0.23.1",
+ "bp256",
+ "bp384",
+ "cbc",
+ "chrono",
+ "crypto-bigint 0.7.11",
+ "des 0.9.0",
+ "ecdsa 0.17.0",
+ "ed25519-dalek 3.0.0",
+ "getrandom 0.4.3",
+ "hmac 0.13.0",
+ "p256 0.14.0",
+ "p384 0.14.0",
+ "p521 0.14.0",
+ "pbkdf2",
+ "rc2",
+ "ripemd 0.2.0",
+ "rsa 0.10.0-rc.18",
+ "sha1 0.11.0",
+ "sha2 0.11.1",
+ "sha3 0.12.0",
+ "thiserror 2.0.21",
+ "zeroize",
+]
+
 [[package]]
 name = "craft-plate-test"
 version = "0.1.0"
@@ -2403,8 +2482,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "36fe21b96d5b87f5de4b5b7202ec41c00110ac817ce6728fe75fb2fe5962ed92"
 dependencies = [
  "cms",
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
  "x509-cert",
 ]
 
@@ -2460,6 +2539,23 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "crypto-bigint"
+version = "0.7.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914c195c4d7fbc5ed7f88d14cbf85914d5c664967658d43404b263913a477e82"
+dependencies = [
+ "cpubits",
+ "ctutils",
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "num-traits",
+ "rand_core 0.10.1",
+ "serdect 0.4.3",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -2477,7 +2573,19 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
+ "getrandom 0.4.3",
  "hybrid-array",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "crypto-primes"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f"
+dependencies = [
+ "crypto-bigint 0.7.11",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -2496,6 +2604,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "261af4dc7a06ea8a527a8717d8cbba3417530d6ea14e1edb3de6b67806be474f"
 dependencies = [
  "cmov",
+ "subtle",
 ]
 
 [[package]]
@@ -2514,7 +2623,23 @@ dependencies = [
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
- "fiat-crypto",
+ "fiat-crypto 0.2.9",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "curve25519-dalek-derive",
+ "digest 0.11.3",
+ "fiat-crypto 0.3.0",
  "rustc_version",
  "subtle",
  "zeroize",
@@ -2537,13 +2662,13 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4c0cf476284b03eb6c10e78787b21c7abb7d7d43cb2f02532ba6b831ed892fa"
 dependencies = [
- "crypto-bigint",
- "elliptic-curve",
- "pkcs8",
+ "crypto-bigint 0.5.5",
+ "elliptic-curve 0.13.8",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
  "serdect 0.3.0",
- "sha3",
- "signature",
+ "sha3 0.10.9",
+ "signature 2.2.0",
  "subtle",
  "zeroize",
 ]
@@ -2607,7 +2732,18 @@ dependencies = [
  "const-oid 0.9.6",
  "der_derive",
  "flagset",
- "pem-rfc7468",
+ "pem-rfc7468 0.7.0",
+ "zeroize",
+]
+
+[[package]]
+name = "der"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a996a108feb8b427a6e12fcf6af4aa83409b79d72c15337d7741368131ee004"
+dependencies = [
+ "const-oid 0.10.3",
+ "pem-rfc7468 1.0.0",
  "zeroize",
 ]
 
@@ -2691,6 +2827,15 @@ dependencies = [
  "cipher 0.4.4",
 ]
 
+[[package]]
+name = "des"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916a94e407b54f9034d71dd748234cd1e516ced6284009906ae246f177eafe5a"
+dependencies = [
+ "cipher 0.5.2",
+]
+
 [[package]]
 name = "dify"
 version = "0.8.0"
@@ -2817,10 +2962,10 @@ dependencies = [
  "digest 0.10.7",
  "num-bigint-dig",
  "num-traits",
- "pkcs8",
- "rfc6979",
+ "pkcs8 0.10.2",
+ "rfc6979 0.4.0",
  "sha2 0.10.9",
- "signature",
+ "signature 2.2.0",
  "zeroize",
 ]
 
@@ -2849,12 +2994,27 @@ version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
- "der",
+ "der 0.7.10",
  "digest 0.10.7",
- "elliptic-curve",
- "rfc6979",
- "signature",
- "spki",
+ "elliptic-curve 0.13.8",
+ "rfc6979 0.4.0",
+ "signature 2.2.0",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "ecdsa"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
+dependencies = [
+ "der 0.8.3",
+ "digest 0.11.3",
+ "elliptic-curve 0.14.3",
+ "rfc6979 0.6.0",
+ "signature 3.0.0",
+ "spki 0.8.1",
+ "zeroize",
 ]
 
 [[package]]
@@ -2873,8 +3033,17 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8",
- "signature",
+ "pkcs8 0.10.2",
+ "signature 2.2.0",
+]
+
+[[package]]
+name = "ed25519"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
+dependencies = [
+ "signature 3.0.0",
 ]
 
 [[package]]
@@ -2883,8 +3052,8 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
- "curve25519-dalek",
- "ed25519",
+ "curve25519-dalek 4.1.3",
+ "ed25519 2.2.3",
  "rand_core 0.6.4",
  "serde",
  "sha2 0.10.9",
@@ -2892,6 +3061,19 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "ed25519-dalek"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
+dependencies = [
+ "curve25519-dalek 5.0.0",
+ "ed25519 3.0.0",
+ "sha2 0.11.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "eframe"
 version = "0.37.0"
@@ -3059,18 +3241,18 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "base64ct",
- "crypto-bigint",
+ "crypto-bigint 0.5.5",
  "digest 0.10.7",
- "ff",
+ "ff 0.13.1",
  "generic-array",
- "group",
+ "group 0.13.0",
  "hkdf",
- "pem-rfc7468",
- "pkcs8",
+ "pem-rfc7468 0.7.0",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "sec1",
+ "sec1 0.7.3",
  "serde_json",
  "serdect 0.2.0",
  "subtle",
@@ -3078,6 +3260,26 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "elliptic-curve"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "900f37e7e18d74a2347389af6cd69e3a30d5cc9e697f40004865679aa75e9c7c"
+dependencies = [
+ "base16ct 1.0.0",
+ "crypto-bigint 0.7.11",
+ "crypto-common 0.2.2",
+ "digest 0.11.3",
+ "ff 0.14.0",
+ "group 0.14.0",
+ "hybrid-array",
+ "pkcs8 0.11.0",
+ "rand_core 0.10.1",
+ "sec1 0.8.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "emath"
 version = "0.37.0"
@@ -3307,12 +3509,28 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "ff"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
+dependencies = [
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
+[[package]]
+name = "fiat-crypto"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
+
 [[package]]
 name = "filetime"
 version = "0.2.29"
@@ -3816,11 +4034,22 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "ff",
+ "ff 0.13.1",
  "rand_core 0.6.4",
  "subtle",
 ]
 
+[[package]]
+name = "group"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
+dependencies = [
+ "ff 0.14.0",
+ "rand_core 0.10.1",
+ "subtle",
+]
+
 [[package]]
 name = "guillotiere"
 version = "0.7.0"
@@ -4083,7 +4312,9 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
 dependencies = [
+ "subtle",
  "typenum",
+ "zeroize",
 ]
 
 [[package]]
@@ -4507,6 +4738,7 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a580c13f0ffc335ef42dd3f6b1a41b726051c5e1656d9a3aa6fddb3c5dfbbf9"
 dependencies = [
+ "block-padding 0.4.2",
  "hybrid-array",
 ]
 
@@ -4846,11 +5078,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
 dependencies = [
  "cfg-if",
- "ecdsa",
- "elliptic-curve",
+ "ecdsa 0.16.9",
+ "elliptic-curve 0.13.8",
  "once_cell",
  "sha2 0.10.9",
- "signature",
+ "signature 2.2.0",
 ]
 
 [[package]]
@@ -4862,6 +5094,16 @@ dependencies = [
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "keccak"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+]
+
 [[package]]
 name = "keyboard-types"
 version = "0.8.3"
@@ -5810,38 +6052,79 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
+ "ecdsa 0.16.9",
+ "elliptic-curve 0.13.8",
+ "primeorder 0.13.6",
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "p256"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
+dependencies = [
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.3",
+ "primefield",
+ "primeorder 0.14.0",
+ "sha2 0.11.1",
+]
+
 [[package]]
 name = "p384"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
 dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
+ "ecdsa 0.16.9",
+ "elliptic-curve 0.13.8",
+ "primeorder 0.13.6",
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "p384"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f"
+dependencies = [
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.3",
+ "fiat-crypto 0.3.0",
+ "primefield",
+ "primeorder 0.14.0",
+ "sha2 0.11.1",
+]
+
 [[package]]
 name = "p521"
 version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
 dependencies = [
- "base16ct",
- "ecdsa",
- "elliptic-curve",
- "primeorder",
+ "base16ct 0.2.0",
+ "ecdsa 0.16.9",
+ "elliptic-curve 0.13.8",
+ "primeorder 0.13.6",
  "rand_core 0.6.4",
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "p521"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449"
+dependencies = [
+ "base16ct 1.0.0",
+ "ecdsa 0.17.0",
+ "elliptic-curve 0.14.3",
+ "primefield",
+ "primeorder 0.14.0",
+ "sha2 0.11.1",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -5888,6 +6171,16 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "pbkdf2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
+dependencies = [
+ "digest 0.11.3",
+ "hmac 0.13.0",
+]
+
 [[package]]
 name = "pdf-writer"
 version = "0.15.0"
@@ -5919,6 +6212,15 @@ dependencies = [
  "base64ct",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "peniko"
 version = "0.6.1"
@@ -5951,7 +6253,7 @@ dependencies = [
  "argon2",
  "base64 0.22.1",
  "bitfields",
- "block-padding",
+ "block-padding 0.3.3",
  "blowfish",
  "buffer-redux",
  "byteorder",
@@ -5962,17 +6264,17 @@ dependencies = [
  "cipher 0.4.4",
  "const-oid 0.9.6",
  "crc24",
- "curve25519-dalek",
+ "curve25519-dalek 4.1.3",
  "cx448",
  "derive_builder",
  "derive_more",
- "des",
+ "des 0.8.1",
  "digest 0.10.7",
  "dsa",
  "eax",
- "ecdsa",
- "ed25519-dalek",
- "elliptic-curve",
+ "ecdsa 0.16.9",
+ "ed25519-dalek 2.2.0",
+ "elliptic-curve 0.13.8",
  "flate2",
  "generic-array",
  "getrandom 0.2.17",
@@ -5988,18 +6290,18 @@ dependencies = [
  "num-traits",
  "num_enum",
  "ocb3",
- "p256",
- "p384",
- "p521",
+ "p256 0.13.2",
+ "p384 0.13.1",
+ "p521 0.13.3",
  "rand 0.8.8",
  "replace_with",
- "ripemd",
- "rsa",
+ "ripemd 0.1.3",
+ "rsa 0.9.10",
  "sha1 0.10.7",
  "sha1-checked",
  "sha2 0.10.9",
- "sha3",
- "signature",
+ "sha3 0.10.9",
+ "signature 2.2.0",
  "smallvec",
  "snafu",
  "subtle",
@@ -6110,9 +6412,19 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
 dependencies = [
- "der",
- "pkcs8",
- "spki",
+ "der 0.7.10",
+ "pkcs8 0.10.2",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs1"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6250dd7321adbe93d12b750aee0ced159fd13e77f625edcdf1cb6f83cd99f650"
+dependencies = [
+ "der 0.8.3",
+ "spki 0.8.1",
 ]
 
 [[package]]
@@ -6121,8 +6433,18 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der",
- "spki",
+ "der 0.7.10",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der 0.8.3",
+ "spki 0.8.1",
 ]
 
 [[package]]
@@ -6292,13 +6614,40 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8cf8e6a8aa66ce33f63993ffc4ea4271eb5b0530a9002db8455ea6050c77bfa"
 
+[[package]]
+name = "primefield"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
+dependencies = [
+ "crypto-bigint 0.7.11",
+ "crypto-common 0.2.2",
+ "ff 0.14.0",
+ "rand_core 0.10.1",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "primeorder"
 version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
- "elliptic-curve",
+ "elliptic-curve 0.13.8",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
+dependencies = [
+ "elliptic-curve 0.14.3",
+ "once_cell",
+ "primefield",
+ "serdect 0.4.3",
+ "wnaf",
 ]
 
 [[package]]
@@ -6598,6 +6947,15 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "rc2"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ceda21af1ae61033b63175653a1af86cae399d79cd03ca80ba347eb3a6c4a7fe"
+dependencies = [
+ "cipher 0.5.2",
+]
+
 [[package]]
 name = "read-fonts"
 version = "0.39.2"
@@ -6771,6 +7129,16 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
+dependencies = [
+ "crypto-bigint 0.7.11",
+ "hmac 0.13.0",
+]
+
 [[package]]
 name = "rfd"
 version = "0.17.2"
@@ -6827,6 +7195,15 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "ripemd"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dd4211456b4172d7e44261920c25acf07367c4f04bb5f5d54fc21b090d9b159"
+dependencies = [
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "roxmltree"
 version = "0.20.0"
@@ -6853,15 +7230,32 @@ dependencies = [
  "num-bigint-dig",
  "num-integer",
  "num-traits",
- "pkcs1",
- "pkcs8",
+ "pkcs1 0.7.5",
+ "pkcs8 0.10.2",
  "rand_core 0.6.4",
- "signature",
- "spki",
+ "signature 2.2.0",
+ "spki 0.7.3",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "rsa"
+version = "0.10.0-rc.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf"
+dependencies = [
+ "const-oid 0.10.3",
+ "crypto-bigint 0.7.11",
+ "crypto-primes",
+ "digest 0.11.3",
+ "pkcs1 0.8.0",
+ "pkcs8 0.11.0",
+ "rand_core 0.10.1",
+ "signature 3.0.0",
+ "zeroize",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -7080,15 +7474,29 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
- "der",
+ "base16ct 0.2.0",
+ "der 0.7.10",
  "generic-array",
- "pkcs8",
+ "pkcs8 0.10.2",
  "serdect 0.2.0",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "sec1"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
+dependencies = [
+ "base16ct 1.0.0",
+ "ctutils",
+ "der 0.8.3",
+ "hybrid-array",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -7226,7 +7634,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "serde",
 ]
 
@@ -7236,7 +7644,17 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
+ "serde",
+]
+
+[[package]]
+name = "serdect"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
+dependencies = [
+ "base16ct 1.0.0",
  "serde",
 ]
 
@@ -7302,7 +7720,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
 dependencies = [
  "digest 0.10.7",
- "keccak",
+ "keccak 0.1.6",
+]
+
+[[package]]
+name = "sha3"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
+dependencies = [
+ "digest 0.11.3",
+ "keccak 0.2.2",
+ "sponge-cursor",
 ]
 
 [[package]]
@@ -7331,6 +7760,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "digest 0.11.3",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "sigstore-bundle"
 version = "0.6.6"
@@ -7358,14 +7797,14 @@ dependencies = [
  "aws-lc-rs",
  "base64 0.22.1",
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "digest 0.10.7",
  "pem",
  "rand_core 0.10.1",
  "sha2 0.10.9",
- "signature",
+ "signature 2.2.0",
  "sigstore-types",
- "spki",
+ "spki 0.7.3",
  "thiserror 2.0.21",
  "tracing",
  "x509-cert",
@@ -7432,7 +7871,7 @@ dependencies = [
  "cmpv2",
  "cms",
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "hex",
  "rand 0.10.3",
  "reqwest",
@@ -7666,9 +8105,25 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der",
+ "der 0.7.10",
 ]
 
+[[package]]
+name = "spki"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef958a98b9d5da290cfc78946e9f3e61e1e62a18db0d92cac0b83cc161491a9"
+dependencies = [
+ "base64ct",
+ "der 0.8.3",
+]
+
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -9543,6 +9998,18 @@ version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
+[[package]]
+name = "wnaf"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "795ca18b3fdb5e62bf982199278341ddcf7ebf7d32e25e212ad05d496e95f6fa"
+dependencies = [
+ "ff 0.14.0",
+ "group 0.14.0",
+ "hybrid-array",
+ "primefield",
+]
+
 [[package]]
 name = "write-fonts"
 version = "0.48.1"
@@ -9631,7 +10098,7 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
- "curve25519-dalek",
+ "curve25519-dalek 4.1.3",
  "rand_core 0.6.4",
  "serde",
  "zeroize",
@@ -9644,10 +10111,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
 dependencies = [
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "sha1 0.10.7",
- "signature",
- "spki",
+ "signature 2.2.0",
+ "spki 0.7.3",
  "tls_codec",
 ]
 
@@ -9659,7 +10126,7 @@ checksum = "f5ceece934a21607055b7ac5c25adb56a2ff559804b10705dc674d1d838c15e1"
 dependencies = [
  "cmpv2",
  "cms",
- "der",
+ "der 0.7.10",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index b026ad3fc..3a7c5c9f3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -93,6 +93,7 @@ craft-ora = { path = "crates/ora" }
 craft-pptx = { path = "crates/pptx" }
 craft-penpot = { path = "crates/penpot" }
 craft-pcraft-format = { path = "crates/pcraft-format" }
+craft-pkcs7 = { path = "crates/pkcs7" }
 craft-plotter = { path = "crates/plotter" }
 craft-prepress = { path = "crates/prepress" }
 craft-print = { path = "crates/print" }
diff --git a/README.md b/README.md
index bc693fc7f..d68b972f8 100644
--- a/README.md
+++ b/README.md
@@ -257,6 +257,10 @@ craft-<name> = { git = "https://github.com/storytold/craft-libs", rev = "<commit
 - [`craft-pcraft-format`](crates/pcraft-format/README.md): the envelope of PhotoCraft's `.pcraft`
   bundle: `Manifest<D>` with the document as a type parameter, `TileRef`, the entry paths, the
   manifest decode limits and the migration runner. The document model stays in PhotoCraft.
+- [`craft-pkcs7`](crates/pkcs7/README.md): the formats of digital signatures, read, verified and
+  written: ASN.1 DER, X.509 certificates and chains, CMS SignedData (PKCS #7), PKCS #12 identity
+  files, RFC 3161 timestamps, and CRL / OCSP revocation evidence. What a signature means for a
+  document or a message stays in each app.
 - [`craft-penpot`](crates/penpot/README.md): clean-room reader and writer for the Penpot 2.x export
   container (`.penpot`): the ZIP archive, its manifest, the per-file, per-page and per-shape JSON
   members and media objects, as the JSON the file holds. Bounded on hostile input. Carved from
diff --git a/crates/pkcs7/Cargo.toml b/crates/pkcs7/Cargo.toml
new file mode 100644
index 000000000..8434a7a55
--- /dev/null
+++ b/crates/pkcs7/Cargo.toml
@@ -0,0 +1,53 @@
+[package]
+name = "craft-pkcs7"
+description = "The formats of digital signatures: ASN.1 DER, X.509 certificates and chains, CMS SignedData (PKCS #7), PKCS #12 identity files, RFC 3161 timestamps, and CRL / OCSP revocation evidence, read, verified and written."
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+# Every dependency here is MIT OR Apache-2.0 (RustCrypto, base64, chrono, thiserror), except
+# ed25519-dalek (BSD-3-Clause) and aws-lc-rs (ISC AND (Apache-2.0 OR ISC)), all on the allowlist.
+[dependencies]
+thiserror = { workspace = true }
+zeroize = "1"
+# ASN.1 UTCTime/GeneralizedTime conversion goes through chrono (no hand-rolled calendar code).
+chrono = { workspace = true }
+base64 = "0.23"
+sha1 = "0.11"
+sha2 = "0.11"
+sha3 = "0.12.0"
+ripemd = "0.2.0"
+p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
+p384 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
+# Verification only: P-521 and the Brainpool curves German qualified-signature cards use.
+p521 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
+bp256 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
+bp384 = { version = "0.14", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
+ecdsa = { version = "0.17", default-features = false, features = ["algorithm", "der"] }
+ed25519-dalek = "3.0.0"
+# Verification only on native targets (RSA private-key operations use aws-lc-rs).
+crypto-bigint = { version = "0.7.11", default-features = false, features = ["alloc"] }
+rsa = { version = "=0.10.0-rc.18", default-features = false, features = ["std", "hazmat"] }
+pbkdf2 = { version = "0.13", default-features = false, features = ["hmac"] }
+hmac = "0.13"
+aes = "0.9"
+cbc = { version = "0.2", features = ["alloc", "block-padding"] }
+des = "0.9"
+rc2 = "0.9"
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+aws-lc-rs = { version = "1.18", default-features = false, features = ["aws-lc-sys", "prebuilt-nasm"] }
+getrandom = "0.4"
+
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+# crypto-bigint asks for randomness; in the browser it comes from Web Crypto.
+getrandom = { version = "0.4", features = ["wasm_js"] }
+
+[[test]]
+name = "it"
+path = "tests/it/main.rs"
diff --git a/crates/pkcs7/README.md b/crates/pkcs7/README.md
new file mode 100644
index 000000000..fc715c3b9
--- /dev/null
+++ b/crates/pkcs7/README.md
@@ -0,0 +1,44 @@
+# craft-pkcs7
+
+The formats of digital signatures, read, verified and written: what a signed PDF, a signed mail
+message or a digital ID file is made of.
+
+- **`der`**: a small BER/DER reader and writer (ITU-T X.690). A `Tlv` borrows from the input and
+  keeps its exact encoding, so a signed structure is verified over the bytes that were signed.
+  Reading is strict DER; `parse_ber` also takes indefinite lengths and segmented strings, which
+  PKCS #12 files from Windows use. Nesting is bounded.
+- **`x509`**: certificates (RFC 5280): names, validity, key, the extensions that matter for
+  signing (basic constraints, key usage, extended key usage, key identifiers, OCSP and CRL
+  locations), `build_chain` / `build_chain_noted` (issuers that may issue, path length, validity,
+  unprocessed critical extensions), `load_certificates` (DER, PEM, PKCS #7 bundles), `to_pem`,
+  and `Certificate::self_signed`. An extension that is present but unreadable restricts: an
+  unreadable key usage allows no usage, an unreadable extended key usage no purpose.
+- **`cms`**: CMS SignedData (RFC 5652): `SignedData::parse` and `verify_signature`,
+  `sign_detached` / `sign_encapsulated`, `certificate_bundle`, and `attach_timestamp_token`.
+- **`pkcs12`**: `.p12` / `.pfx` (RFC 7292): `open` reads PBES2 (PBKDF2 with HMAC-SHA-1/2;
+  AES-CBC or 3DES-CBC) and the legacy PBE schemes (SHA-1 with 3DES or RC2) and checks the MAC,
+  stopping at a fixed amount of key-derivation work; `write` uses PBES2 AES-256-CBC with
+  PBKDF2-HMAC-SHA-256.
+- **`timestamp`**: RFC 3161 requests, responses and tokens, and a responder for a local
+  stamping identity. No transport: `TimestampAuthority` is the caller's.
+- **`revocation`**: CRLs (RFC 5280) and OCSP responses (RFC 6960): parsed, their signatures
+  verified, and a certificate's status looked up. Nothing is fetched.
+- **`keys`**: digests (SHA-1, SHA-2, SHA-3, RIPEMD-160), public keys for verification (RSA
+  PKCS #1 v1.5 and PSS, ECDSA on P-256, P-384, P-521 and the Brainpool curves, Ed25519) and
+  private keys for signing (RSA, P-256, P-384, or a key held elsewhere behind `ExternalKey`).
+
+What a signature means for a document or a message stays with the caller: which bytes it covers,
+what changed after it, which certificates are trusted, and how a result is worded.
+
+## Cryptography
+
+The primitives are RustCrypto's; RSA private-key operations use aws-lc-rs on native targets.
+Two things are done in this crate, both verification only and on public data, because no audited
+crate offers them: the RSA signature paddings for any digest, MGF1 hash and salt length
+(`rsa_pad`, over the `rsa` crate's raw public-key operation), and ECDSA on brainpoolP512r1
+(`ec512`, over `crypto-bigint`). Both are checked against signatures made by OpenSSL.
+
+Weak algorithms are read, not refused, because old signed documents use them:
+`DigestAlg::weakness` and `PublicKey::weakness` say when one is weak, and the caller decides.
+
+Moved from PdfCraft's `pdfcraft-sign`.
diff --git a/crates/pkcs7/src/cms.rs b/crates/pkcs7/src/cms.rs
new file mode 100644
index 000000000..083aa4302
--- /dev/null
+++ b/crates/pkcs7/src/cms.rs
@@ -0,0 +1,595 @@
+//! CMS SignedData (RFC 5652) as PDF signatures use it: detached (`adbe.pkcs7.detached`,
+//! `ETSI.CAdES.detached`) or with the digest encapsulated (`adbe.pkcs7.sha1`).
+
+use crate::Error;
+use crate::der::{self, Time, Tlv, tag};
+use crate::keys::{DigestAlg, PrivateKey, Scheme, signature_algorithm};
+use crate::x509::Certificate;
+
+pub const SIGNED_DATA: &str = "1.2.840.113549.1.7.2";
+pub const DATA: &str = "1.2.840.113549.1.7.1";
+const CONTENT_TYPE: &str = "1.2.840.113549.1.9.3";
+const MESSAGE_DIGEST: &str = "1.2.840.113549.1.9.4";
+const SIGNING_TIME: &str = "1.2.840.113549.1.9.5";
+const SIGNING_CERT_V2: &str = "1.2.840.113549.1.9.16.2.47";
+const SIGNING_CERT: &str = "1.2.840.113549.1.9.16.2.12";
+const TIMESTAMP_TOKEN: &str = "1.2.840.113549.1.9.16.2.14";
+
+/// How a signer names its certificate.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum SignerId {
+    IssuerSerial { issuer: Vec<u8>, serial: Vec<u8> },
+    KeyId(Vec<u8>),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SignerInfo {
+    pub sid: SignerId,
+    pub digest: DigestAlg,
+    /// The signed attributes as the SET that was signed (`None`: the signature covers the
+    /// content itself).
+    pub signed_attrs: Option<Vec<u8>>,
+    pub message_digest: Option<Vec<u8>>,
+    pub content_type: Option<String>,
+    pub signing_time: Option<Time>,
+    /// ESS signing-certificate(-v2) present (CAdES).
+    pub signing_certificate: bool,
+    pub scheme: Scheme,
+    /// The digest named by the signature algorithm, when it names one.
+    pub scheme_digest: Option<DigestAlg>,
+    pub signature: Vec<u8>,
+    /// An RFC 3161 timestamp token is attached (unsigned attribute).
+    pub timestamp: bool,
+    /// The attached token's raw CMS bytes, when present.
+    pub timestamp_token: Option<Vec<u8>>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SignedData {
+    pub certificates: Vec<Certificate>,
+    pub signer: SignerInfo,
+    /// Encapsulated content (`adbe.pkcs7.sha1` carries the document digest here).
+    pub content: Option<Vec<u8>>,
+    /// `eContentType`, the type of the encapsulated content: data for a PDF signature, TSTInfo
+    /// for an RFC 3161 token. The signature does not cover it.
+    pub econtent_type: String,
+    /// Encoding irregularities that were tolerated (BER instead of DER, …), for the details.
+    pub quirks: Vec<&'static str>,
+}
+
+/// The X.509 certificates in a SignedData `certificates` field (`[0] IMPLICIT CertificateSet`).
+/// Other certificate formats (attribute certificates) and certificates that don't parse are
+/// skipped.
+fn carried_certificates(set: &Tlv) -> Result<Vec<Certificate>, Error> {
+    let mut out = Vec::new();
+    for c in set.children()? {
+        if c.tag == tag::SEQUENCE
+            && let Ok(cert) = Certificate::parse(c.raw)
+        {
+            out.push(cert);
+        }
+    }
+    Ok(out)
+}
+
+/// The certificates of a PKCS #7 certificate bundle (`.p7b`, `.p7c`): a SignedData with no
+/// signers ("degenerate", RFC 5652 §5.2), which is how Windows, Acrobat and certificate
+/// authorities hand out a chain or a set of CA certificates. Signers and CRLs, if present, are
+/// ignored; only the certificates are read. DER or BER.
+pub fn certificate_bundle(bytes: &[u8]) -> Result<Vec<Certificate>, Error> {
+    let (ci, rest) = Tlv::parse_ber(bytes)?;
+    // A trust file is the bundle alone: bytes after it mean a damaged or spliced file.
+    if !rest.is_empty() {
+        return Err(bad("data after the bundle"));
+    }
+    let ci = ci.expect(tag::SEQUENCE, "ContentInfo")?.children()?;
+    let [ct, content] = ci.as_slice() else { return Err(bad("ContentInfo")) };
+    if ct.oid()? != SIGNED_DATA {
+        return Err(bad("not SignedData"));
+    }
+    let sd = content.expect(tag::ctx(0), "content")?.inner()?.children()?;
+    // version, digestAlgorithms, encapContentInfo, the optional [0] certificates and [1] CRLs,
+    // then signerInfos (RFC 5652 §5.1).
+    let [version, digests, encap, middle @ .., signers] = sd.as_slice() else { return Err(bad("SignedData")) };
+    let shape = [(version, tag::INTEGER), (digests, tag::SET), (encap, tag::SEQUENCE), (signers, tag::SET)];
+    // At most one [0] certificates and one [1] CRLs, in that order.
+    const CERTS: u8 = tag::ctx(0);
+    const CRLS: u8 = tag::ctx(1);
+    let middle_ok = matches!(middle.iter().map(|t| t.tag).collect::<Vec<_>>().as_slice(), [] | [CERTS] | [CRLS] | [CERTS, CRLS]);
+    // encapContentInfo starts with its eContentType OID.
+    let encap_ok = encap.children()?.first().is_some_and(|t| t.tag == tag::OID);
+    if shape.iter().any(|(t, want)| t.tag != *want) || !middle_ok || !encap_ok {
+        return Err(bad("SignedData"));
+    }
+    let mut certificates = Vec::new();
+    for t in middle.iter().filter(|t| t.tag == tag::ctx(0)) {
+        certificates.extend(carried_certificates(t)?);
+    }
+    if certificates.is_empty() {
+        return Err(bad("the bundle holds no certificate"));
+    }
+    Ok(certificates)
+}
+
+fn bad(what: &str) -> Error {
+    Error::Malformed(format!("CMS: {what}"))
+}
+
+impl SignedData {
+    /// Parse a `ContentInfo` holding SignedData. Bytes after it (a PDF placeholder's zero
+    /// padding) are ignored.
+    pub fn parse(bytes: &[u8]) -> Result<SignedData, Error> {
+        // CMS from DocuSign, Documenso, Windows and `openssl cms -stream` is BER (indefinite lengths,
+        // segmented strings). Only its structure is read this way: certificates and signed
+        // attributes are still verified over their own exact bytes.
+        let (ci, _) = Tlv::parse_ber(bytes)?;
+        let mut quirks = Vec::new();
+        if ci.is_indefinite() {
+            quirks.push("The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.");
+        }
+        let ci = ci.expect(tag::SEQUENCE, "ContentInfo")?.children()?;
+        let [ct, content] = ci.as_slice() else { return Err(bad("ContentInfo")) };
+        if ct.oid()? != SIGNED_DATA {
+            return Err(bad("not SignedData"));
+        }
+        let sd = content.expect(tag::ctx(0), "content")?.inner()?.children()?;
+        let mut it = sd.into_iter();
+        let _version = it.next();
+        let _digest_algs = it.next();
+        let encap = it.next().ok_or_else(|| bad("encapContentInfo"))?.children()?;
+        let econtent_type = encap.first().ok_or_else(|| bad("eContentType"))?.oid()?;
+        let content = match encap.get(1) {
+            Some(c) if c.tag == tag::ctx(0) => {
+                // BER signers may split the content into a constructed OCTET STRING.
+                let inner = c.inner()?;
+                if inner.tag != tag::OCTET_STRING {
+                    quirks.push("The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.");
+                }
+                Some(inner.octets("eContent")?.into_owned())
+            }
+            _ => None,
+        };
+        let mut certificates = Vec::new();
+        let mut signer_infos = None;
+        for t in it {
+            match t.tag {
+                t2 if t2 == tag::ctx(0) => certificates.extend(carried_certificates(&t)?),
+                tag::SET => signer_infos = Some(t),
+                _ => {}
+            }
+        }
+        let infos = signer_infos.ok_or_else(|| bad("no signerInfos"))?.children()?;
+        let si = infos.first().ok_or_else(|| bad("no signer"))?;
+        let signer = parse_signer(si)?;
+        // RFC 5652 §11.1: the content-type attribute names the type of the encapsulated content.
+        // The signature covers the attribute but not `eContentType`, so when they differ, one of
+        // them was written wrong or changed after signing.
+        if let Some(signed) = &signer.content_type
+            && *signed != econtent_type
+        {
+            return Err(bad("the signed content type is not the encapsulated content type"));
+        }
+        Ok(SignedData { certificates, signer, content, econtent_type, quirks })
+    }
+
+    /// The signer's certificate among those carried.
+    pub fn signer_certificate(&self) -> Option<&Certificate> {
+        self.certificates.iter().find(|c| match &self.signer.sid {
+            SignerId::IssuerSerial { issuer, serial } => &c.issuer.raw == issuer && strip(&c.serial) == strip(serial),
+            SignerId::KeyId(k) => c.subject_key_id.as_ref() == Some(k),
+        })
+    }
+
+    /// Check the signature value with `cert`'s key. `content_digest` is the digest of the
+    /// signed content (the document byte ranges) when there are no signed attributes.
+    /// `Err(Unsupported)`: the signer's key algorithm can't be checked here.
+    pub fn verify_signature(&self, cert: &Certificate, content_digest: &[u8]) -> Result<bool, Error> {
+        self.verify_signature_noting(cert, content_digest, &mut Vec::new())
+    }
+
+    /// [`SignedData::verify_signature`], noting in `notes` each encoding irregularity or
+    /// disagreement it tolerated. Only meaningful when it returns `Ok(true)`.
+    pub fn verify_signature_noting(&self, cert: &Certificate, content_digest: &[u8], notes: &mut Vec<&'static str>) -> Result<bool, Error> {
+        let s = &self.signer;
+        // EdDSA signs the message itself: with signed attributes, their DER encoding.
+        if s.scheme == Scheme::Ed25519 {
+            let Some(attrs) = &s.signed_attrs else {
+                return Err(Error::Unsupported("Ed25519 signature without signed attributes".into()));
+            };
+            return cert.public_key.verify_message(s.scheme, attrs, &s.signature);
+        }
+        // The signature algorithm names the digest it used; a bare `rsaEncryption` / `ecPublicKey`
+        // uses the SignerInfo's digestAlgorithm. Some signers disagree, so try both.
+        let named = s.scheme_digest.unwrap_or(s.digest);
+        let mut algs = vec![named];
+        if !algs.contains(&s.digest) {
+            algs.push(s.digest);
+        }
+        for alg in algs {
+            let digest = match &s.signed_attrs {
+                Some(attrs) => alg.digest(&[attrs]),
+                None => content_digest.to_vec(),
+            };
+            // Notes from an attempt that doesn't verify say nothing about the signature.
+            let mut attempt = Vec::new();
+            if cert.public_key.verify_noting(s.scheme, alg, &digest, &s.signature, &mut attempt)? {
+                notes.extend(attempt);
+                // The hash of the content and the hash the signature is made with.
+                for weak in [s.digest, alg].into_iter().filter_map(DigestAlg::weakness) {
+                    if !notes.contains(&weak) {
+                        notes.push(weak);
+                    }
+                }
+                if alg != named {
+                    notes.push("The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.");
+                }
+                return Ok(true);
+            }
+        }
+        Ok(false)
+    }
+}
+
+fn strip(mut b: &[u8]) -> &[u8] {
+    while let [0, rest @ ..] = b
+        && !rest.is_empty()
+    {
+        b = rest;
+    }
+    b
+}
+
+fn parse_signer_id(sid: &Tlv<'_>) -> Result<SignerId, Error> {
+    match sid.tag {
+        tag::SEQUENCE => {
+            let p = sid.children()?;
+            let [issuer, serial] = p.as_slice() else { return Err(bad("issuerAndSerialNumber")) };
+            if issuer.tag != tag::SEQUENCE || serial.tag != tag::INTEGER || serial.value.is_empty() {
+                return Err(bad("issuerAndSerialNumber"));
+            }
+            Ok(SignerId::IssuerSerial { issuer: issuer.raw.to_vec(), serial: serial.value.to_vec() })
+        }
+        t if t == tag::ctx_prim(0) => Ok(SignerId::KeyId(sid.value.to_vec())),
+        t if t == tag::ctx(0) => {
+            let key_id = match sid.inner() {
+                Ok(inner) if matches!(inner.tag, tag::OCTET_STRING | tag::OCTET_STRING_SEGMENTS) => inner.octets("sid")?.into_owned(),
+                _ => {
+                    let mut seg = *sid;
+                    seg.tag = tag::OCTET_STRING_SEGMENTS;
+                    seg.octets("sid")?.into_owned()
+                }
+            };
+            Ok(SignerId::KeyId(key_id))
+        }
+        _ => Err(bad("sid")),
+    }
+}
+
+type SignedAttrs = (Vec<u8>, Option<Vec<u8>>, Option<String>, Option<Time>, bool);
+
+fn parse_signed_attrs(attrs: &Tlv<'_>) -> Result<SignedAttrs, Error> {
+    // Signed over the DER SET OF, i.e. the same contents with the universal SET tag.
+    // (An indefinite-length encoding is re-encoded with a definite length.)
+    let mut set = if attrs.is_indefinite() { der::tlv(tag::SET, attrs.value) } else { attrs.raw.to_vec() };
+    if let Some(t) = set.first_mut() {
+        *t = tag::SET;
+    }
+    let (mut message_digest, mut content_type, mut signing_time, mut signing_certificate) = (None, None, None, false);
+    let (mut seen_type, mut seen_digest) = (false, false);
+    for a in attrs.children()? {
+        let p = a.children()?;
+        let Some(o) = p.first().and_then(|o| o.oid().ok()) else { continue };
+        let values = p.get(1).and_then(|v| v.children().ok()).unwrap_or_default();
+        // RFC 5652 §11.1 and §11.2: one content-type and one message-digest attribute, each
+        // with one value. With a second one, two readers could each take a different value.
+        let (seen, what) = match o.as_str() {
+            CONTENT_TYPE => (Some(&mut seen_type), "content type"),
+            MESSAGE_DIGEST => (Some(&mut seen_digest), "message digest"),
+            _ => (None, ""),
+        };
+        if let Some(seen) = seen
+            && (std::mem::replace(seen, true) || values.len() != 1)
+        {
+            return Err(bad(&format!("the signed attributes must hold one {what} with one value")));
+        }
+        let value = values.into_iter().next();
+        match (o.as_str(), value) {
+            (MESSAGE_DIGEST, Some(v)) => message_digest = Some(v.value.to_vec()),
+            // A value that is not an OID would skip every content-type check after this.
+            (CONTENT_TYPE, Some(v)) => content_type = Some(v.oid()?),
+            (SIGNING_TIME, Some(v)) => signing_time = v.time().ok(),
+            (SIGNING_CERT_V2 | SIGNING_CERT, _) => signing_certificate = true,
+            _ => {}
+        }
+    }
+    Ok((set, message_digest, content_type, signing_time, signing_certificate))
+}
+
+fn parse_signer(si: &Tlv<'_>) -> Result<SignerInfo, Error> {
+    let f = si.children()?;
+    let mut it = f.into_iter();
+    let _version = it.next();
+    let sid = parse_signer_id(&it.next().ok_or_else(|| bad("sid"))?)?;
+    let digest_alg = it.next().ok_or_else(|| bad("digestAlgorithm"))?.children()?;
+    let d_oid = digest_alg.first().ok_or_else(|| bad("digestAlgorithm"))?.oid()?;
+    let digest = DigestAlg::from_oid(&d_oid).ok_or_else(|| Error::Unsupported(format!("digest {d_oid}")))?;
+    let mut next = it.next().ok_or_else(|| bad("signatureAlgorithm"))?;
+    let (mut signed_attrs, mut message_digest, mut content_type, mut signing_time, mut signing_certificate) = (None, None, None, None, false);
+    if next.tag == tag::ctx(0) {
+        let (set, md, ct, st, sc) = parse_signed_attrs(&next)?;
+        (signed_attrs, message_digest, content_type, signing_time, signing_certificate) = (Some(set), md, ct, st, sc);
+        next = it.next().ok_or_else(|| bad("signatureAlgorithm"))?;
+    }
+    let (scheme, scheme_digest) = signature_algorithm(&next)?;
+    let signature = it.next().ok_or_else(|| bad("signature"))?.octets("signature")?.into_owned();
+    let (timestamp, timestamp_token) = parse_timestamp_token(it)?;
+    Ok(SignerInfo {
+        sid,
+        digest,
+        signed_attrs,
+        message_digest,
+        content_type,
+        signing_time,
+        signing_certificate,
+        scheme,
+        scheme_digest,
+        signature,
+        timestamp,
+        timestamp_token,
+    })
+}
+
+fn parse_timestamp_token<'a>(it: impl Iterator<Item = Tlv<'a>>) -> Result<(bool, Option<Vec<u8>>), Error> {
+    let mut timestamp = false;
+    let mut timestamp_token = None;
+    for t in it {
+        if t.tag == tag::ctx(1) {
+            for a in t.children()? {
+                let kids = a.children()?;
+                if kids.first().and_then(|o| o.oid().ok()).as_deref() == Some(TIMESTAMP_TOKEN) {
+                    timestamp = true;
+                    // The value is a SET OF ContentInfo: the token's own encoding.
+                    let set = kids.get(1).and_then(|s| s.children().ok());
+                    timestamp_token = set.and_then(|c| c.first().copied()).map(|ci| ci.raw.to_vec());
+                }
+            }
+        }
+    }
+    Ok((timestamp, timestamp_token))
+}
+
+fn merge_unsigned_attrs(signer_kids: &[Tlv<'_>], token_attr: Vec<u8>) -> Result<Vec<Vec<u8>>, Error> {
+    let mut parts: Vec<Vec<u8>> = signer_kids.iter().map(|t| t.raw.to_vec()).collect();
+    let mut attrs = Vec::new();
+    if let Some(last) = signer_kids.last()
+        && last.tag == tag::ctx(1)
+    {
+        parts.pop();
+        for a in last.children()? {
+            let is_ts = a.children()?.first().and_then(|o| o.oid().ok()).as_deref() == Some(TIMESTAMP_TOKEN);
+            if !is_ts {
+                attrs.push(a.raw.to_vec());
+            }
+        }
+    }
+    attrs.push(token_attr);
+    let attr_refs: Vec<&[u8]> = attrs.iter().map(Vec::as_slice).collect();
+    let mut unsigned = der::set_of(&attr_refs);
+    if let Some(first) = unsigned.first_mut() {
+        *first = tag::ctx(1);
+    }
+    parts.push(unsigned);
+    Ok(parts)
+}
+
+/// Attach an RFC 3161 `signatureTimeStampToken` unsigned attribute to a detached CMS object.
+/// The signed attributes and signature value are preserved byte-for-byte.
+pub fn attach_timestamp_token(cms: &[u8], token: &[u8]) -> Result<Vec<u8>, Error> {
+    let (content_info, _) = Tlv::parse(cms)?;
+    let ci = content_info.expect(tag::SEQUENCE, "ContentInfo")?.children()?;
+    let [content_type, wrapped] = ci.as_slice() else { return Err(bad("ContentInfo")) };
+    if content_type.oid()? != SIGNED_DATA {
+        return Err(bad("not SignedData"));
+    }
+    let signed_data = wrapped.expect(tag::ctx(0), "content")?.inner()?;
+    let mut sd = signed_data.children()?;
+    // signerInfos is the last field of SignedData (RFC 5652 §5.1); searching from the end
+    // skips the SET OF digest algorithms.
+    let signer_index = sd.iter().rposition(|t| t.tag == tag::SET).ok_or_else(|| bad("no signerInfos"))?;
+    let signer_set = sd[signer_index];
+    let signer = signer_set.children()?.first().copied().ok_or_else(|| bad("no signer"))?;
+    let signer_kids = signer.children()?;
+    if signer_kids.len() < 6 {
+        return Err(bad("malformed signerInfo"));
+    }
+    let attr = der::seq(&[&der::oid(TIMESTAMP_TOKEN), &der::set_of(&[token])]);
+    let signer_parts = merge_unsigned_attrs(&signer_kids, attr)?;
+    let signer_refs: Vec<&[u8]> = signer_parts.iter().map(Vec::as_slice).collect();
+    let new_signer = der::seq(&signer_refs);
+    let new_signer_set = der::set_of(&[&new_signer]);
+    sd[signer_index] = Tlv::parse_all(&new_signer_set)?;
+    let sd_refs: Vec<&[u8]> = sd.iter().map(|t| t.raw).collect();
+    let new_sd = der::seq(&sd_refs);
+    let wrapped_new = der::explicit(0, &new_sd);
+    Ok(der::seq(&[&der::oid(SIGNED_DATA), &wrapped_new]))
+}
+fn attribute(o: &str, value: &[u8]) -> Vec<u8> {
+    der::seq(&[&der::oid(o), &der::set_of(&[value])])
+}
+
+/// A detached CAdES signature (PAdES B-B): signed attributes content-type, message-digest and
+/// signing-certificate-v2 (no signing-time: PAdES takes the time from the signature
+/// dictionary's `/M`). `chain` holds further certificates to embed (issuers).
+pub fn sign_detached(key: &PrivateKey, cert: &Certificate, chain: &[Certificate], alg: DigestAlg, content_digest: &[u8]) -> Result<Vec<u8>, Error> {
+    build(SignedDataInput { key, cert, chain, alg, content_type: DATA, content: None, content_digest })
+}
+
+/// A CMS SignedData that encapsulates `content` under `content_type` (an RFC 3161 token wraps
+/// its TSTInfo this way).
+pub fn sign_encapsulated(
+    key: &PrivateKey,
+    cert: &Certificate,
+    chain: &[Certificate],
+    alg: DigestAlg,
+    content_type: &str,
+    content: &[u8],
+) -> Result<Vec<u8>, Error> {
+    let content_digest = alg.digest(&[content]);
+    build(SignedDataInput { key, cert, chain, alg, content_type, content: Some(content), content_digest: &content_digest })
+}
+
+/// The values needed to assemble a CMS SignedData object.
+struct SignedDataInput<'a> {
+    key: &'a PrivateKey,
+    cert: &'a Certificate,
+    chain: &'a [Certificate],
+    alg: DigestAlg,
+    content_type: &'a str,
+    content: Option<&'a [u8]>,
+    content_digest: &'a [u8],
+}
+
+fn build(input: SignedDataInput<'_>) -> Result<Vec<u8>, Error> {
+    let SignedDataInput { key, cert, chain, alg, content_type, content, content_digest } = input;
+    let cert_hash = DigestAlg::Sha256.digest(&[&cert.raw]);
+    let general_names = der::seq(&[&der::explicit(4, &cert.issuer.raw)]);
+    // The serial as the certificate has it: `cert.serial` is the INTEGER's own bytes, so one with
+    // its high bit set gets no leading zero here.
+    let serial = der::tlv(tag::INTEGER, if cert.serial.is_empty() { &[0] } else { &cert.serial });
+    let ess = der::seq(&[&der::seq(&[&der::seq(&[&der::octets(&cert_hash), &der::seq(&[&general_names, &serial])])])]);
+    let attrs =
+        [attribute(CONTENT_TYPE, &der::oid(content_type)), attribute(MESSAGE_DIGEST, &der::octets(content_digest)), attribute(SIGNING_CERT_V2, &ess)];
+    let refs: Vec<&[u8]> = attrs.iter().map(Vec::as_slice).collect();
+    let set = der::set_of(&refs);
+    let signature = key.sign(alg, &set)?;
+    let mut signed_attrs = set.clone();
+    signed_attrs[0] = tag::ctx(0);
+    let sid = der::seq(&[&cert.issuer.raw, &serial]);
+    let signer = der::seq(&[&der::int(1), &sid, &alg.algorithm(), &signed_attrs, &key.signature_algorithm(alg), &der::octets(&signature)]);
+    let mut certs: Vec<&[u8]> = vec![&cert.raw];
+    certs.extend(chain.iter().filter(|c| c.raw != cert.raw).map(|c| c.raw.as_slice()));
+    let encap = match content {
+        Some(c) => der::seq(&[&der::oid(content_type), &der::explicit(0, &der::octets(c))]),
+        None => der::seq(&[&der::oid(content_type)]),
+    };
+    let signed_data =
+        der::seq(&[&der::int(1), &der::set_of(&[&alg.algorithm()]), &encap, &der::tlv(tag::ctx(0), &certs.concat()), &der::set_of(&[&signer])]);
+    Ok(der::seq(&[&der::oid(SIGNED_DATA), &der::explicit(0, &signed_data)]))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn strip_removes_multiple_leading_zero_bytes() {
+        assert_eq!(strip(&[0, 0, 0, 0x42]), &[0x42]);
+        assert_eq!(strip(&[0, 0, 0]), &[0]);
+    }
+
+    #[test]
+    fn parse_signer_handles_constructed_key_id_and_rejects_invalid_sid_tags() {
+        let alg = DigestAlg::Sha256.algorithm();
+        let sig_alg = der::seq(&[&der::oid("1.2.840.113549.1.1.11")]);
+        let sig = der::octets(&[1, 2, 3, 4]);
+
+        // Constructed [0] wrapping an OCTET STRING key identifier.
+        let sid_explicit = der::explicit(0, &der::octets(&[0xAA, 0xBB, 0xCC]));
+        let si_explicit = der::seq(&[&der::int(3), &sid_explicit, &alg, &sig_alg, &sig]);
+        let parsed = parse_signer(&Tlv::parse_all(&si_explicit).expect("valid DER")).expect("explicit [0] KeyId should parse");
+        assert_eq!(parsed.sid, SignerId::KeyId(vec![0xAA, 0xBB, 0xCC]));
+
+        // Invalid sid tag (OCTET STRING instead of SEQUENCE or [0]).
+        let bad_sid = der::octets(&[0xAA]);
+        let si_bad = der::seq(&[&der::int(1), &bad_sid, &alg, &sig_alg, &sig]);
+        assert!(parse_signer(&Tlv::parse_all(&si_bad).expect("valid DER")).is_err());
+
+        // IssuerAndSerialNumber with non-INTEGER serial.
+        let bad_ias = der::seq(&[&der::seq(&[]), &der::octets(&[1])]);
+        let si_bad_ias = der::seq(&[&der::int(1), &bad_ias, &alg, &sig_alg, &sig]);
+        assert!(parse_signer(&Tlv::parse_all(&si_bad_ias).expect("valid DER")).is_err());
+    }
+
+    #[test]
+    fn attach_timestamp_token_merges_into_single_unsigned_attrs_set() {
+        let issuer = der::seq(&[]);
+        let sid = der::seq(&[&issuer, &der::int(1)]);
+        let alg = DigestAlg::Sha256.algorithm();
+        let sig_alg = der::seq(&[&der::oid("1.2.840.113549.1.1.11")]);
+        let signed_attrs = der::tlv(tag::ctx(0), &attribute(CONTENT_TYPE, &der::oid(DATA)));
+        let sig = der::octets(&[0x11, 0x22]);
+        let other_attr = attribute("1.2.3.4", &der::octets(&[0x99]));
+        let existing_unsigned = der::tlv(tag::ctx(1), &other_attr);
+        let signer = der::seq(&[&der::int(1), &sid, &alg, &signed_attrs, &sig_alg, &sig, &existing_unsigned]);
+        let encap = der::seq(&[&der::oid(DATA)]);
+        let sd = der::seq(&[&der::int(1), &der::set_of(&[&alg]), &encap, &der::set_of(&[&signer])]);
+        let cms = der::seq(&[&der::oid(SIGNED_DATA), &der::explicit(0, &sd)]);
+
+        let tok1 = der::seq(&[&der::oid(SIGNED_DATA), &der::explicit(0, &der::seq(&[]))]);
+        let tok2 = der::seq(&[&der::oid(SIGNED_DATA), &der::explicit(0, &der::seq(&[&der::int(1)]))]);
+
+        let with_tok1 = attach_timestamp_token(&cms, &tok1).expect("first attach");
+        let with_tok2 = attach_timestamp_token(&with_tok1, &tok2).expect("second attach replaces token in single [1]");
+
+        // Inspect raw SignerInfo children: must have exactly one [1] unsignedAttrs element.
+        let (ci, _) = Tlv::parse(&with_tok2).expect("valid cms");
+        let sd_children = ci.children().expect("ci")[1].inner().expect("sd").children().expect("sd kids");
+        let si_tlv = sd_children.last().expect("signerInfos").children().expect("set")[0];
+        let si_kids = si_tlv.children().expect("si kids");
+        let unsigned_fields: Vec<_> = si_kids.iter().filter(|t| t.tag == tag::ctx(1)).collect();
+        assert_eq!(unsigned_fields.len(), 1, "SignerInfo must contain at most one [1] unsignedAttrs field");
+        assert_eq!(unsigned_fields[0].children().expect("attrs").len(), 2, "other unsigned attr preserved alongside replaced timestamp token");
+
+        let parsed = SignedData::parse(&with_tok2).expect("parsed SignedData");
+        assert!(parsed.signer.timestamp);
+        assert_eq!(parsed.signer.timestamp_token.as_deref(), Some(tok2.as_slice()));
+    }
+
+    /// A self-signed certificate whose serial number is exactly `serial` (the INTEGER's bytes).
+    fn certificate_with_serial(key: &PrivateKey, serial: &[u8]) -> Certificate {
+        use crate::x509::Name;
+        let name = Name::build("High-Bit Serial Signer", "", "", "", "");
+        let alg = key.preferred_digest();
+        let sig_alg = key.signature_algorithm(alg);
+        let from = Time { year: 2026, month: 1, day: 1, hour: 0, minute: 0, second: 0 };
+        let until = Time { year: 2027, ..from };
+        let tbs = der::seq(&[
+            &der::explicit(0, &der::int(2)),
+            &der::tlv(tag::INTEGER, serial),
+            &sig_alg,
+            &name.raw,
+            &der::seq(&[&from.encode(), &until.encode()]),
+            &name.raw,
+            &key.public_key().spki(),
+        ]);
+        let signature = key.sign(alg, &tbs).expect("signed");
+        Certificate::parse(&der::seq(&[&tbs, &sig_alg, &der::bit_string(&signature)])).expect("certificate")
+    }
+
+    #[test]
+    fn build_preserves_high_bit_certificate_serial_verbatim_in_sid_and_ess() {
+        let key = PrivateKey::generate_p256().expect("key");
+        let neg_serial = vec![0xEA, 0xE4, 0x80, 0x7F, 0xC7, 0x49, 0x4C, 0x35, 0x8D, 0x58];
+        let cert = certificate_with_serial(&key, &neg_serial);
+        assert_eq!(cert.serial, neg_serial);
+
+        let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+        let cms_bytes = sign_detached(&key, &cert, &[], DigestAlg::Sha256, &digest).expect("signed");
+        let parsed = SignedData::parse(&cms_bytes).expect("parsed SignedData");
+        assert_eq!(parsed.signer.sid, SignerId::IssuerSerial { issuer: cert.issuer.raw.clone(), serial: neg_serial.clone() });
+        assert_eq!(parsed.signer_certificate(), Some(&cert));
+        assert!(parsed.verify_signature(&cert, &digest).expect("verified"));
+
+        let expected_tlv = der::tlv(tag::INTEGER, &neg_serial);
+        let padded_tlv = der::uint(&neg_serial);
+        let signed_attrs = parsed.signer.signed_attrs.as_deref().expect("signed attributes");
+        assert!(
+            signed_attrs.windows(expected_tlv.len()).any(|w| w == expected_tlv.as_slice()),
+            "ESSCertIDv2 must encode the certificate serial verbatim"
+        );
+        assert!(
+            !signed_attrs.windows(padded_tlv.len()).any(|w| w == padded_tlv.as_slice()),
+            "ESSCertIDv2 must not prepend a leading 0x00 to a high-bit certificate serial"
+        );
+    }
+}
diff --git a/crates/pkcs7/src/der.rs b/crates/pkcs7/src/der.rs
new file mode 100644
index 000000000..d9960e258
--- /dev/null
+++ b/crates/pkcs7/src/der.rs
@@ -0,0 +1,663 @@
+//! A small BER/DER reader and writer (ITU-T X.690): just what X.509, CMS and PKCS#12 need.
+//!
+//! [`Tlv`] borrows from the input and keeps its full encoding (`raw`), so signed structures can
+//! be verified over the exact bytes that were signed.
+//!
+//! Reading is strict DER by default, which is what everything signed must use. [`Tlv::parse_ber`]
+//! also accepts the two BER constructions a reader meets in practice — the indefinite length form
+//! and strings split into segments — which PKCS #12 needs: Windows writes `.p12` files that way.
+//! Writing is always DER.
+
+use std::borrow::Cow;
+
+use crate::Error;
+
+/// Universal tags (single-byte identifiers).
+pub mod tag {
+    pub const BOOLEAN: u8 = 0x01;
+    pub const INTEGER: u8 = 0x02;
+    pub const ENUMERATED: u8 = 0x0A;
+    pub const BIT_STRING: u8 = 0x03;
+    pub const OCTET_STRING: u8 = 0x04;
+    /// An OCTET STRING split into segments (BER only, X.690 §8.21); see [`super::Tlv::octets`].
+    pub const OCTET_STRING_SEGMENTS: u8 = 0x24;
+    pub const NULL: u8 = 0x05;
+    pub const OID: u8 = 0x06;
+    pub const UTF8_STRING: u8 = 0x0C;
+    pub const PRINTABLE_STRING: u8 = 0x13;
+    pub const T61_STRING: u8 = 0x14;
+    pub const IA5_STRING: u8 = 0x16;
+    pub const UTC_TIME: u8 = 0x17;
+    pub const GENERALIZED_TIME: u8 = 0x18;
+    pub const BMP_STRING: u8 = 0x1E;
+    pub const SEQUENCE: u8 = 0x30;
+    pub const SET: u8 = 0x31;
+    /// `[n]` context-specific, constructed (EXPLICIT, or IMPLICIT over a constructed type).
+    pub const fn ctx(n: u8) -> u8 {
+        0xA0 | n
+    }
+    /// `[n]` context-specific, primitive (IMPLICIT over a primitive type).
+    pub const fn ctx_prim(n: u8) -> u8 {
+        0x80 | n
+    }
+}
+
+fn bad(what: &str) -> Error {
+    Error::Malformed(what.to_string())
+}
+
+/// Which encoding rules a reader accepts.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Form {
+    /// DER: every length definite, every string primitive. Anything whose bytes are signed is read
+    /// this way, so that what is verified is exactly what was written.
+    Der,
+    /// BER as well: the indefinite length form (X.690 §8.1.3.6) and strings split into segments
+    /// (§8.21).
+    Ber,
+}
+
+/// One BER/DER element.
+#[derive(Clone, Copy, Debug, Eq)]
+pub struct Tlv<'a> {
+    pub tag: u8,
+    /// The contents octets (without the end-of-contents octets of an indefinite length).
+    pub value: &'a [u8],
+    /// The whole encoding (identifier, length, contents and any end-of-contents octets).
+    pub raw: &'a [u8],
+    /// The rules this element was read with. Its children are read the same way.
+    form: Form,
+}
+
+/// Two elements are equal when they encode the same thing; the rules they were read with are not
+/// part of that.
+impl PartialEq for Tlv<'_> {
+    fn eq(&self, other: &Self) -> bool {
+        self.tag == other.tag && self.value == other.value && self.raw == other.raw
+    }
+}
+
+impl<'a> Tlv<'a> {
+    /// Parse one DER element at the start of `input`; returns it and the rest.
+    pub fn parse(input: &'a [u8]) -> Result<(Tlv<'a>, &'a [u8]), Error> {
+        Tlv::read(input, Form::Der, 0)
+    }
+
+    /// Parse one BER element at the start of `input`; returns it and the rest.
+    pub fn parse_ber(input: &'a [u8]) -> Result<(Tlv<'a>, &'a [u8]), Error> {
+        Tlv::read(input, Form::Ber, 0)
+    }
+
+    fn read(input: &'a [u8], form: Form, depth: usize) -> Result<(Tlv<'a>, &'a [u8]), Error> {
+        let (&tag, rest) = input.split_first().ok_or_else(|| bad("truncated DER"))?;
+        if tag & 0x1F == 0x1F {
+            return Err(bad("multi-byte DER tags are not supported"));
+        }
+        let (&first, rest) = rest.split_first().ok_or_else(|| bad("truncated DER length"))?;
+        // `trailer` is the two end-of-contents octets, which belong to the element but not to its
+        // contents.
+        let (len, rest, trailer) = if first < 0x80 {
+            (first as usize, rest, 0)
+        } else if first == 0x80 {
+            if form == Form::Der {
+                return Err(bad("indefinite lengths are not allowed in DER"));
+            }
+            if tag & 0x20 == 0 {
+                return Err(bad("an indefinite length needs a constructed element"));
+            }
+            (contents_len(rest, form, depth)?, rest, 2)
+        } else {
+            let n = (first & 0x7F) as usize;
+            if n > 4 || rest.len() < n {
+                return Err(bad("unsupported DER length"));
+            }
+            let len = rest[..n].iter().fold(0usize, |acc, b| (acc << 8) | *b as usize);
+            (len, &rest[n..], 0)
+        };
+        let end = len.checked_add(trailer).ok_or_else(|| bad("DER length overflows"))?;
+        if rest.len() < end {
+            return Err(bad("DER element runs past the end"));
+        }
+        // `end <= rest.len()`, so neither sum below can overflow.
+        let header = input.len() - rest.len();
+        Ok((Tlv { tag, value: &rest[..len], raw: &input[..header + end], form }, &rest[end..]))
+    }
+
+    /// Parse `input` as exactly one DER element.
+    pub fn parse_all(input: &'a [u8]) -> Result<Tlv<'a>, Error> {
+        Tlv::only(input, Form::Der)
+    }
+
+    /// Parse `input` as exactly one BER element.
+    pub fn parse_all_ber(input: &'a [u8]) -> Result<Tlv<'a>, Error> {
+        Tlv::only(input, Form::Ber)
+    }
+
+    fn only(input: &'a [u8], form: Form) -> Result<Tlv<'a>, Error> {
+        let (t, rest) = Tlv::read(input, form, 0)?;
+        if !rest.is_empty() {
+            return Err(bad("trailing bytes after DER element"));
+        }
+        Ok(t)
+    }
+
+    /// Whether this element is written with the indefinite length form (BER, never DER). Tags are
+    /// single-octet here, so the length octet is the second.
+    pub fn is_indefinite(&self) -> bool {
+        self.raw.get(1) == Some(&0x80)
+    }
+
+    /// The children of a constructed element, read with the same rules as their parent.
+    pub fn children(&self) -> Result<Vec<Tlv<'a>>, Error> {
+        let mut out = Vec::new();
+        let mut rest = self.value;
+        while !rest.is_empty() {
+            let (t, r) = Tlv::read(rest, self.form, 0)?;
+            out.push(t);
+            rest = r;
+        }
+        Ok(out)
+    }
+
+    /// Check the tag, for a clear error.
+    pub fn expect(self, tag: u8, what: &str) -> Result<Tlv<'a>, Error> {
+        if self.tag == tag { Ok(self) } else { Err(bad(&format!("{what}: expected tag {tag:#04x}, found {:#04x}", self.tag))) }
+    }
+
+    /// The element inside an EXPLICIT tag.
+    pub fn inner(&self) -> Result<Tlv<'a>, Error> {
+        Tlv::only(self.value, self.form)
+    }
+
+    /// An OCTET STRING's contents, joining the segments of BER's constructed form (X.690 §8.21).
+    /// Borrowed in the ordinary case, so the common path copies nothing.
+    pub fn octets(&self, what: &str) -> Result<Cow<'a, [u8]>, Error> {
+        self.join(what, 0)
+    }
+
+    fn join(&self, what: &str, depth: usize) -> Result<Cow<'a, [u8]>, Error> {
+        /// Deep enough for anything real: a writer that segments at all segments once.
+        const MAX_DEPTH: usize = 16;
+        match self.tag {
+            tag::OCTET_STRING => Ok(Cow::Borrowed(self.value)),
+            tag::OCTET_STRING_SEGMENTS if self.form == Form::Ber => {
+                if depth >= MAX_DEPTH {
+                    return Err(bad(&format!("{what}: OCTET STRING segments nested too deeply")));
+                }
+                // The join is never larger than the segments it is made of, so this is bounded by
+                // the input.
+                let mut out: Vec<u8> = Vec::with_capacity(self.value.len());
+                for s in self.children()? {
+                    out.extend_from_slice(&s.join(what, depth + 1)?);
+                }
+                Ok(Cow::Owned(out))
+            }
+            found => Err(bad(&format!("{what}: expected an OCTET STRING, found tag {found:#04x}"))),
+        }
+    }
+
+    /// An OID in dotted form.
+    pub fn oid(&self) -> Result<String, Error> {
+        if self.tag != tag::OID {
+            return Err(bad("expected an OID"));
+        }
+        oid_to_string(self.value)
+    }
+
+    /// A non-negative INTEGER that fits in a u64.
+    pub fn u64(&self) -> Result<u64, Error> {
+        // (nine bytes only with a 0x00 pad: a nonzero first byte is past 64 bits)
+        if self.tag != tag::INTEGER
+            || self.value.is_empty()
+            || self.value.len() > 9
+            || self.value[0] & 0x80 != 0
+            || (self.value.len() == 9 && self.value[0] != 0)
+        {
+            return Err(bad("expected a small non-negative INTEGER"));
+        }
+        Ok(self.value.iter().fold(0u64, |acc, b| (acc << 8) | *b as u64))
+    }
+
+    /// A non-negative ENUMERATED that fits in a u64 (same encoding as an INTEGER).
+    pub fn enumerated(&self) -> Result<u64, Error> {
+        if self.tag != tag::ENUMERATED {
+            return Err(bad("expected an ENUMERATED"));
+        }
+        Tlv { tag: tag::INTEGER, ..*self }.u64()
+    }
+
+    /// The magnitude of an INTEGER (leading zero dropped).
+    pub fn uint_bytes(&self) -> &'a [u8] {
+        match self.value {
+            [0, rest @ ..] if !rest.is_empty() => rest,
+            v => v,
+        }
+    }
+
+    /// A BIT STRING's bytes (no unused bits allowed).
+    pub fn bits(&self) -> Result<&'a [u8], Error> {
+        match self.value {
+            [0, rest @ ..] if self.tag == tag::BIT_STRING => Ok(rest),
+            _ => Err(bad("expected a whole-byte BIT STRING")),
+        }
+    }
+
+    /// A string type as text (UTF-8, Printable, IA5, T61 as Latin-1, BMP).
+    pub fn text(&self) -> Option<String> {
+        match self.tag {
+            tag::UTF8_STRING | tag::PRINTABLE_STRING | tag::IA5_STRING => Some(String::from_utf8_lossy(self.value).into_owned()),
+            tag::T61_STRING => Some(self.value.iter().map(|b| *b as char).collect()),
+            tag::BMP_STRING => {
+                let units: Vec<u16> = self.value.as_chunks::<2>().0.iter().map(|c| u16::from_be_bytes([c[0], c[1]])).collect();
+                Some(String::from_utf16_lossy(&units))
+            }
+            _ => None,
+        }
+    }
+
+    /// UTCTime / GeneralizedTime as (year, month, day, hour, minute, second) in UTC.
+    pub fn time(&self) -> Result<Time, Error> {
+        let s = std::str::from_utf8(self.value).map_err(|_| bad("time"))?;
+        let s = s.strip_suffix('Z').ok_or_else(|| bad("times must be in UTC (Z)"))?;
+        let num = |r: std::ops::Range<usize>| s.get(r).and_then(|x| x.parse::<u32>().ok()).ok_or_else(|| bad("time"));
+        let (year, rest) = match self.tag {
+            tag::UTC_TIME => {
+                let y = num(0..2)?;
+                (if y >= 50 { 1900 + y } else { 2000 + y }, 2)
+            }
+            tag::GENERALIZED_TIME => (num(0..4)?, 4),
+            _ => return Err(bad("expected a time")),
+        };
+        let t = Time {
+            year,
+            month: num(rest..rest + 2)?,
+            day: num(rest + 2..rest + 4)?,
+            hour: num(rest + 4..rest + 6)?,
+            minute: num(rest + 6..rest + 8)?,
+            second: if s.len() >= rest + 10 { num(rest + 8..rest + 10)? } else { 0 },
+        };
+        Ok(t)
+    }
+}
+
+/// How many contents octets an indefinite-length element has: everything up to the matching
+/// end-of-contents octets, which have to be there (X.690 §8.1.5). The contents are elements, so
+/// finding the end means reading them, and one of those may be indefinite too — hence the depth
+/// limit. Every step consumes at least two octets, so the walk always ends.
+fn contents_len(input: &[u8], form: Form, depth: usize) -> Result<usize, Error> {
+    /// Far deeper than any real file nests, and shallow enough never to exhaust the stack.
+    const MAX_DEPTH: usize = 48;
+    if depth >= MAX_DEPTH {
+        return Err(bad("BER elements nested too deeply"));
+    }
+    let mut rest = input;
+    loop {
+        match rest {
+            [] => return Err(bad("an indefinite length with no end-of-contents")),
+            [0, 0, ..] => return Ok(input.len() - rest.len()),
+            _ => rest = Tlv::read(rest, form, depth + 1)?.1,
+        }
+    }
+}
+
+/// `NaiveDate::num_days_from_ce` of 1970-01-01, so the count can be rebased onto the Unix epoch.
+const UNIX_EPOCH_DAYS_FROM_CE: i64 = 719_163;
+
+/// A UTC time.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct Time {
+    pub year: u32,
+    pub month: u32,
+    pub day: u32,
+    pub hour: u32,
+    pub minute: u32,
+    pub second: u32,
+}
+
+impl Time {
+    /// From a PDF date (`D:YYYYMMDDHHmmSS±HH'mm'`), converted to UTC.
+    pub fn from_pdf(s: &str) -> Option<Time> {
+        let s = s.strip_prefix("D:").unwrap_or(s);
+        let d = |r: std::ops::Range<usize>, default: u32| s.get(r).map_or(Some(default), |x| x.parse::<u32>().ok());
+        let mut t =
+            Time { year: d(0..4, 0)?, month: d(4..6, 1)?, day: d(6..8, 1)?, hour: d(8..10, 0)?, minute: d(10..12, 0)?, second: d(12..14, 0)? };
+        if t.year == 0 {
+            return None;
+        }
+        let tz = s.get(14..).unwrap_or("");
+        let sign = match tz.chars().next() {
+            Some('+') => -1i64,
+            Some('-') => 1,
+            _ => 0,
+        };
+        if sign != 0 {
+            let h = tz.get(1..3).and_then(|x| x.parse::<i64>().ok()).unwrap_or(0);
+            let m = tz.get(4..6).and_then(|x| x.parse::<i64>().ok()).unwrap_or(0);
+            t = t.add_seconds(sign * (h * 3600 + m * 60));
+        }
+        Some(t)
+    }
+
+    /// As a PDF date in UTC (`D:YYYYMMDDHHmmSSZ`).
+    pub fn to_pdf(&self) -> String {
+        format!("D:{:04}{:02}{:02}{:02}{:02}{:02}Z", self.year, self.month, self.day, self.hour, self.minute, self.second)
+    }
+
+    /// Seconds since 1970-01-01 (proleptic Gregorian).
+    pub fn unix(&self) -> i64 {
+        use chrono::Datelike;
+        // The calendar date goes through chrono; the time of day is a plain second count, as
+        // before. A date chrono cannot represent (an out-of-range field) reads as the epoch day,
+        // which no well-formed UTCTime/GeneralizedTime produces.
+        let days = i32::try_from(self.year)
+            .ok()
+            .and_then(|y| chrono::NaiveDate::from_ymd_opt(y, self.month, self.day))
+            .map_or(0, |d| i64::from(d.num_days_from_ce()) - UNIX_EPOCH_DAYS_FROM_CE);
+        days * 86_400 + self.hour as i64 * 3600 + self.minute as i64 * 60 + self.second as i64
+    }
+
+    /// The UTC time at `t` seconds since 1970-01-01.
+    ///
+    /// The calendar date goes through chrono's 400-year Gregorian cycle (146_097 days) so a `t`
+    /// past `NaiveDate`'s ±262143-year range keeps the proleptic Gregorian date the old hand-rolled
+    /// converter produced instead of falling back to the epoch. The `year` field is a `u32`, so the
+    /// year is cast exactly as the old code did (`as u32`, wrapping) — no well-formed signing time
+    /// is anywhere near that range, and this preserves byte-for-byte the old output everywhere.
+    pub fn from_unix(t: i64) -> Time {
+        let (days, secs) = (t.div_euclid(86_400), t.rem_euclid(86_400));
+        let (year, month, day) = civil_from_days(days);
+        Time { year: year as u32, month, day, hour: (secs / 3600) as u32, minute: (secs % 3600 / 60) as u32, second: (secs % 60) as u32 }
+    }
+
+    pub fn add_seconds(&self, s: i64) -> Time {
+        Time::from_unix(self.unix() + s)
+    }
+
+    /// UTCTime before 2050, GeneralizedTime from then on (RFC 5280 §4.1.2.5).
+    pub fn encode(&self) -> Vec<u8> {
+        if (1950..2050).contains(&self.year) {
+            let s = format!("{:02}{:02}{:02}{:02}{:02}{:02}Z", self.year % 100, self.month, self.day, self.hour, self.minute, self.second);
+            tlv(tag::UTC_TIME, s.as_bytes())
+        } else {
+            let s = format!("{:04}{:02}{:02}{:02}{:02}{:02}Z", self.year, self.month, self.day, self.hour, self.minute, self.second);
+            tlv(tag::GENERALIZED_TIME, s.as_bytes())
+        }
+    }
+}
+
+impl std::fmt::Display for Time {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:04}.{:02}.{:02} {:02}:{:02}:{:02} UTC", self.year, self.month, self.day, self.hour, self.minute, self.second)
+    }
+}
+
+/// The proleptic Gregorian date `days` after 1970-01-01, through chrono's 400-year cycle so that
+/// any `i64` day count has a date.
+fn civil_from_days(days: i64) -> (i64, u32, u32) {
+    use chrono::Datelike;
+    let (cycles, rest) = (days.div_euclid(146_097), days.rem_euclid(146_097));
+    // `rest + 719_163` is 719_163..865_259, always a valid CE day.
+    match i32::try_from(rest + UNIX_EPOCH_DAYS_FROM_CE).ok().and_then(chrono::NaiveDate::from_num_days_from_ce_opt) {
+        Some(d) => {
+            let y = i128::from(d.year()) + i128::from(cycles) * 400;
+            (i64::try_from(y).unwrap_or(if y < 0 { i64::MIN } else { i64::MAX }), d.month(), d.day())
+        }
+        None => (1970, 1, 1),
+    }
+}
+
+fn oid_to_string(v: &[u8]) -> Result<String, Error> {
+    let mut arcs: Vec<u64> = Vec::new();
+    let mut acc = 0u64;
+    for (i, b) in v.iter().enumerate() {
+        acc = acc.checked_mul(128).ok_or_else(|| bad("OID arc too large"))? | (b & 0x7F) as u64;
+        if b & 0x80 == 0 {
+            if arcs.is_empty() {
+                let first = (acc / 40).min(2);
+                arcs.push(first);
+                arcs.push(acc - first * 40);
+            } else {
+                arcs.push(acc);
+            }
+            acc = 0;
+        } else if i + 1 == v.len() {
+            return Err(bad("truncated OID"));
+        }
+    }
+    Ok(arcs.iter().map(u64::to_string).collect::<Vec<_>>().join("."))
+}
+
+// ── writing ─────────────────────────────────────────────────────────────────────────────────
+
+/// One element: identifier, definite length, contents.
+pub fn tlv(tag: u8, value: &[u8]) -> Vec<u8> {
+    let mut out = vec![tag];
+    let n = value.len();
+    if n < 0x80 {
+        out.push(n as u8);
+    } else {
+        let bytes: Vec<u8> = n.to_be_bytes().iter().copied().skip_while(|b| *b == 0).collect();
+        out.push(0x80 | bytes.len() as u8);
+        out.extend(bytes);
+    }
+    out.extend_from_slice(value);
+    out
+}
+
+pub fn seq(parts: &[&[u8]]) -> Vec<u8> {
+    tlv(tag::SEQUENCE, &parts.concat())
+}
+
+/// A SET OF, in DER order (sorted encodings, X.690 §11.6).
+pub fn set_of(parts: &[&[u8]]) -> Vec<u8> {
+    let mut v: Vec<&[u8]> = parts.to_vec();
+    v.sort();
+    tlv(tag::SET, &v.concat())
+}
+
+pub fn explicit(n: u8, inner: &[u8]) -> Vec<u8> {
+    tlv(tag::ctx(n), inner)
+}
+
+/// The encoding of an OID constant (callers pass only literals from this crate).
+// The documented never-crash exception: every caller passes a literal that always parses.
+#[allow(clippy::expect_used)]
+pub fn oid(dotted: &str) -> Vec<u8> {
+    let arcs: Vec<u64> = dotted.split('.').map(|a| a.parse().expect("valid OID constant")).collect();
+    let mut body = Vec::new();
+    let mut push = |mut v: u64| {
+        let mut tmp = vec![(v & 0x7F) as u8];
+        v >>= 7;
+        while v > 0 {
+            tmp.push(0x80 | (v & 0x7F) as u8);
+            v >>= 7;
+        }
+        tmp.reverse();
+        body.extend(tmp);
+    };
+    push(arcs[0] * 40 + arcs[1]);
+    for a in &arcs[2..] {
+        push(*a);
+    }
+    tlv(tag::OID, &body)
+}
+
+/// Encode a dotted OID supplied by a caller. Unlike [`oid`], this validates every arc and
+/// never panics on malformed input.
+pub fn try_oid(dotted: &str) -> Result<Vec<u8>, Error> {
+    let mut arcs = dotted.split('.').map(|a| {
+        if a.is_empty() || !a.bytes().all(|c| c.is_ascii_digit()) {
+            return Err(bad("invalid OID arc"));
+        }
+        a.parse::<u64>().map_err(|_| bad("invalid OID arc"))
+    });
+    let first = arcs.next().ok_or_else(|| bad("empty OID"))??;
+    let second = arcs.next().ok_or_else(|| bad("OID needs two arcs"))??;
+    if first > 2 || (first < 2 && second >= 40) {
+        return Err(bad("invalid OID prefix"));
+    }
+    let mut body = Vec::new();
+    let mut push = |mut v: u64| {
+        let mut tmp = vec![(v & 0x7F) as u8];
+        v >>= 7;
+        while v > 0 {
+            tmp.push(0x80 | (v & 0x7F) as u8);
+            v >>= 7;
+        }
+        tmp.reverse();
+        body.extend(tmp);
+    };
+    let base = first.checked_mul(40).and_then(|b| b.checked_add(second)).ok_or_else(|| bad("invalid OID prefix"))?;
+    push(base);
+    for arc in arcs {
+        push(arc?);
+    }
+    Ok(tlv(tag::OID, &body))
+}
+pub fn uint(bytes: &[u8]) -> Vec<u8> {
+    let b: &[u8] = match bytes.iter().position(|x| *x != 0) {
+        Some(i) => &bytes[i..],
+        None => &[0],
+    };
+    if b[0] & 0x80 != 0 {
+        let mut v = vec![0];
+        v.extend_from_slice(b);
+        tlv(tag::INTEGER, &v)
+    } else {
+        tlv(tag::INTEGER, b)
+    }
+}
+
+pub fn int(n: u64) -> Vec<u8> {
+    uint(&n.to_be_bytes())
+}
+
+pub fn octets(b: &[u8]) -> Vec<u8> {
+    tlv(tag::OCTET_STRING, b)
+}
+
+pub fn bit_string(b: &[u8]) -> Vec<u8> {
+    let mut v = vec![0];
+    v.extend_from_slice(b);
+    tlv(tag::BIT_STRING, &v)
+}
+
+pub fn null() -> Vec<u8> {
+    vec![tag::NULL, 0]
+}
+
+pub fn utf8(s: &str) -> Vec<u8> {
+    tlv(tag::UTF8_STRING, s.as_bytes())
+}
+
+pub fn printable(s: &str) -> Vec<u8> {
+    tlv(tag::PRINTABLE_STRING, s.as_bytes())
+}
+
+pub fn ia5(s: &str) -> Vec<u8> {
+    tlv(tag::IA5_STRING, s.as_bytes())
+}
+
+pub fn boolean(b: bool) -> Vec<u8> {
+    tlv(tag::BOOLEAN, &[if b { 0xFF } else { 0 }])
+}
+
+/// `AlgorithmIdentifier` with optional parameters.
+pub fn algorithm(oid_s: &str, params: Option<&[u8]>) -> Vec<u8> {
+    match params {
+        Some(p) => seq(&[&oid(oid_s), p]),
+        None => seq(&[&oid(oid_s)]),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_nine_byte_integer_needs_a_zero_pad_to_fit_64_bits() {
+        let tlv = |value: &[u8]| {
+            let mut b = vec![tag::INTEGER, value.len() as u8];
+            b.extend_from_slice(value);
+            b
+        };
+        // 2^64 would fold to 0: refused, not read as 0
+        assert!(Tlv::parse_all(&tlv(&[1, 0, 0, 0, 0, 0, 0, 0, 0])).unwrap().u64().is_err());
+        // u64::MAX with its pad is fine
+        let max = [0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff];
+        assert_eq!(Tlv::parse_all(&tlv(&max)).unwrap().u64().unwrap(), u64::MAX);
+    }
+
+    #[test]
+    fn try_oid_rejects_signs_and_empty_arcs() {
+        for bad in ["+1.2.840", "1.+2", "1.2.-3", "1..2"] {
+            assert!(try_oid(bad).is_err(), "accepted {bad}");
+        }
+        assert_eq!(try_oid("1.2.840.113549").unwrap(), oid("1.2.840.113549"));
+    }
+
+    #[test]
+    fn round_trips() {
+        let o = oid("1.2.840.113549.1.7.2");
+        let t = Tlv::parse_all(&o).unwrap();
+        assert_eq!(t.oid().unwrap(), "1.2.840.113549.1.7.2");
+        let big = vec![7u8; 300];
+        let e = octets(&big);
+        assert_eq!(&e[..4], &[0x04, 0x82, 0x01, 0x2C]);
+        assert_eq!(Tlv::parse_all(&e).unwrap().value, &big[..]);
+        assert_eq!(uint(&[0x80, 1]), vec![0x02, 3, 0, 0x80, 1]);
+        assert_eq!(Tlv::parse_all(&int(65537)).unwrap().u64().unwrap(), 65537);
+        let s = set_of(&[&int(2), &int(1)]);
+        assert_eq!(s, vec![0x31, 6, 2, 1, 1, 2, 1, 2]);
+        assert!(Tlv::parse(&[0x30, 5, 1]).is_err());
+    }
+
+    #[test]
+    fn reads_ber_indefinite_lengths_and_segmented_strings() {
+        // SEQUENCE { INTEGER 3, OCTET STRING { "hi", "!" } }, every wrapper in the indefinite form:
+        // the shape Windows gives a .p12 file.
+        let ber: &[u8] = &[0x30, 0x80, 0x02, 0x01, 0x03, 0x24, 0x80, 0x04, 0x02, b'h', b'i', 0x04, 0x01, b'!', 0, 0, 0, 0];
+        let e = Tlv::parse_all(ber).unwrap_err().to_string();
+        assert!(e.contains("indefinite lengths are not allowed in DER"), "{e}");
+
+        let t = Tlv::parse_all_ber(ber).unwrap();
+        assert_eq!(t.tag, tag::SEQUENCE);
+        assert_eq!(t.raw, ber, "the end-of-contents octets belong to the element");
+        assert_eq!(t.value, &ber[2..ber.len() - 2], "but not to its contents");
+        let c = t.children().unwrap();
+        assert_eq!(c[0].u64().unwrap(), 3);
+        assert_eq!(c[1].octets("segments").unwrap().as_ref(), b"hi!", "the segments are joined");
+        assert!(c[0].octets("not a string").is_err());
+
+        // Definite lengths read the same either way, and a segmented string stays a DER error.
+        assert_eq!(Tlv::parse_all_ber(&int(65537)).unwrap().u64().unwrap(), 65537);
+        assert_eq!(Tlv::parse_all_ber(&octets(b"hi!")).unwrap().octets("plain").unwrap().as_ref(), b"hi!");
+        assert!(Tlv::parse_all(&[0x24, 2, 0x04, 0]).unwrap().octets("segments").is_err());
+
+        // Malformed: no end-of-contents, and an indefinite length on a primitive element.
+        assert!(Tlv::parse_all_ber(&ber[..ber.len() - 2]).is_err());
+        assert!(Tlv::parse_all_ber(&[0x04, 0x80, 0, 0]).is_err());
+        // Nesting is bounded, so a file made of nothing but wrappers fails instead of crashing.
+        let deep = [[0x30u8, 0x80].repeat(400), [0u8, 0].repeat(400)].concat();
+        assert!(Tlv::parse_all_ber(&deep).is_err());
+    }
+
+    #[test]
+    fn times() {
+        let t = Time { year: 2026, month: 10, day: 2, hour: 9, minute: 30, second: 5 };
+        assert_eq!(Time::from_unix(t.unix()), t);
+        assert_eq!(Tlv::parse_all(&t.encode()).unwrap().time().unwrap(), t);
+        let far = Time { year: 2051, ..t };
+        assert_eq!(Tlv::parse_all(&far.encode()).unwrap().tag, tag::GENERALIZED_TIME);
+        assert_eq!(Time::from_pdf("D:20261002113005+02'00'"), Some(Time { year: 2026, month: 10, day: 2, hour: 9, minute: 30, second: 5 }));
+        assert_eq!(Time::from_unix(0), Time { year: 1970, month: 1, day: 1, hour: 0, minute: 0, second: 0 });
+        // Past chrono's ±262143-year range `from_unix` keeps the proleptic Gregorian date the old
+        // hand-rolled converter gave, not the epoch. No real signing time is near this; the `year`
+        // field is a `u32`, so the year wraps exactly as the old `as u32` cast did (values pinned
+        // from the old formula). This also covers both i64 extremes so neither div_euclid panics.
+        assert_eq!(Time::from_unix(10_000_000_000_000), Time { year: 318857, month: 5, day: 20, hour: 17, minute: 46, second: 40 });
+        assert_eq!(Time::from_unix(-10_000_000_000_000), Time { year: 4_294_652_378, month: 8, day: 13, hour: 6, minute: 13, second: 20 });
+        assert_eq!(Time::from_unix(i64::MAX), Time { year: 219_250_468, month: 12, day: 4, hour: 15, minute: 30, second: 7 });
+        assert_eq!(Time::from_unix(i64::MIN), Time { year: 4_075_720_767, month: 1, day: 27, hour: 8, minute: 29, second: 52 });
+    }
+}
diff --git a/crates/pkcs7/src/ec512.rs b/crates/pkcs7/src/ec512.rs
new file mode 100644
index 000000000..3e4c0e307
--- /dev/null
+++ b/crates/pkcs7/src/ec512.rs
@@ -0,0 +1,180 @@
+//! ECDSA verification on brainpoolP512r1 (RFC 5639), for which no RustCrypto curve crate exists.
+//!
+//! Verification only, on public data, so plain affine arithmetic over `crypto-bigint` is enough:
+//! no secret is involved, and a verification takes a few milliseconds. Checked against
+//! signatures made by OpenSSL (`tests/it/crypto.rs`).
+
+use rsa::BoxedUint;
+
+const P: &str = "aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3";
+const A: &str = "7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca";
+const B: &str = "3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723";
+const GX: &str = "81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822";
+const GY: &str = "7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892";
+const N: &str = "aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069";
+
+const BITS: u32 = 512;
+const BYTES: usize = 64;
+
+type Point = Option<(BoxedUint, BoxedUint)>;
+
+fn big(bytes: &[u8]) -> Option<BoxedUint> {
+    let pad = BYTES.checked_sub(bytes.len())?;
+    let mut v = vec![0u8; pad];
+    v.extend_from_slice(bytes);
+    BoxedUint::from_be_slice(&v, BITS).ok()
+}
+
+fn hex(s: &str) -> Option<BoxedUint> {
+    let bytes: Option<Vec<u8>> = (0..s.len()).step_by(2).map(|i| u8::from_str_radix(s.get(i..i + 2)?, 16).ok()).collect();
+    big(&bytes?)
+}
+
+/// Arithmetic modulo a prime.
+struct Field {
+    nz: crypto_bigint::NonZero<BoxedUint>,
+}
+
+impl Field {
+    fn new(p: BoxedUint) -> Option<Field> {
+        let nz = Option::from(crypto_bigint::NonZero::new(p))?;
+        Some(Field { nz })
+    }
+    fn add(&self, a: &BoxedUint, b: &BoxedUint) -> BoxedUint {
+        a.add_mod(b, &self.nz)
+    }
+    fn sub(&self, a: &BoxedUint, b: &BoxedUint) -> BoxedUint {
+        a.sub_mod(b, &self.nz)
+    }
+    fn mul(&self, a: &BoxedUint, b: &BoxedUint) -> BoxedUint {
+        a.mul_mod(b, &self.nz)
+    }
+    fn inv(&self, a: &BoxedUint) -> Option<BoxedUint> {
+        Option::from(a.invert_mod(&self.nz))
+    }
+    /// Whether `v` is reduced (`v < p`). `add_mod`, `sub_mod` and friends assert it, and panic on
+    /// anything else, so nothing from outside may reach them without this check.
+    fn is_reduced(&self, v: &BoxedUint) -> bool {
+        v < self.nz.as_ref()
+    }
+}
+
+struct Curve {
+    f: Field,
+    a: BoxedUint,
+    b: BoxedUint,
+    g: (BoxedUint, BoxedUint),
+    n: BoxedUint,
+}
+
+impl Curve {
+    fn brainpool_p512r1() -> Option<Curve> {
+        Some(Curve { f: Field::new(hex(P)?)?, a: hex(A)?, b: hex(B)?, g: (hex(GX)?, hex(GY)?), n: hex(N)? })
+    }
+
+    fn on_curve(&self, x: &BoxedUint, y: &BoxedUint) -> bool {
+        let f = &self.f;
+        let lhs = f.mul(y, y);
+        let rhs = f.add(&f.add(&f.mul(&f.mul(x, x), x), &f.mul(&self.a, x)), &self.b);
+        lhs == rhs
+    }
+
+    fn double(&self, p: &Point) -> Point {
+        let (x, y) = p.as_ref()?;
+        let f = &self.f;
+        if bool::from(y.is_zero()) {
+            return None;
+        }
+        let three = big(&[3])?;
+        let two = big(&[2])?;
+        let num = f.add(&f.mul(&three, &f.mul(x, x)), &self.a);
+        let lambda = f.mul(&num, &f.inv(&f.mul(&two, y))?);
+        let x3 = f.sub(&f.sub(&f.mul(&lambda, &lambda), x), x);
+        let y3 = f.sub(&f.mul(&lambda, &f.sub(x, &x3)), y);
+        Some((x3, y3))
+    }
+
+    fn add(&self, p: &Point, q: &Point) -> Point {
+        let (Some((x1, y1)), Some((x2, y2))) = (p, q) else { return p.clone().or_else(|| q.clone()) };
+        let f = &self.f;
+        if x1 == x2 {
+            return if y1 == y2 { self.double(p) } else { None };
+        }
+        let lambda = f.mul(&f.sub(y2, y1), &f.inv(&f.sub(x2, x1))?);
+        let x3 = f.sub(&f.sub(&f.mul(&lambda, &lambda), x1), x2);
+        let y3 = f.sub(&f.mul(&lambda, &f.sub(x1, &x3)), y1);
+        Some((x3, y3))
+    }
+
+    /// `k · p`, double-and-add from the top bit.
+    fn mul(&self, k: &BoxedUint, p: &Point) -> Point {
+        let mut acc: Point = None;
+        for i in (0..k.bit_width_vartime()).rev() {
+            acc = self.double(&acc);
+            if bool::from(k.bit(i)) {
+                acc = self.add(&acc, p);
+            }
+        }
+        acc
+    }
+}
+
+/// Check the ECDSA signature `r ‖ s` (64 bytes each) of `digest` with the SEC1 uncompressed
+/// point `public` (`04 ‖ x ‖ y`). `None`: the key is not a valid point or the input is malformed.
+pub fn verify(public: &[u8], digest: &[u8], rs: &[u8]) -> Option<bool> {
+    let c = Curve::brainpool_p512r1()?;
+    let [0x04, xy @ ..] = public else { return None };
+    if xy.len() != 2 * BYTES || rs.len() != 2 * BYTES {
+        return None;
+    }
+    let (qx, qy) = (big(xy.get(..BYTES)?)?, big(xy.get(BYTES..)?)?);
+    // SEC 1 §2.3.4: coordinates are field elements. The field arithmetic panics on unreduced ones.
+    if !c.f.is_reduced(&qx) || !c.f.is_reduced(&qy) || !c.on_curve(&qx, &qy) {
+        return None;
+    }
+    let (r, s) = (big(rs.get(..BYTES)?)?, big(rs.get(BYTES..)?)?);
+    let n = crypto_bigint::NonZero::new(c.n.clone());
+    let n: crypto_bigint::NonZero<BoxedUint> = Option::from(n)?;
+    let zero = |v: &BoxedUint| bool::from(v.is_zero());
+    if zero(&r) || zero(&s) || r >= c.n || s >= c.n {
+        return Some(false);
+    }
+    // The leftmost 512 bits of the digest (all of it, for digests up to SHA-512).
+    let e = big(digest.get(..digest.len().min(BYTES))?)?.rem_vartime(&n);
+    let w: BoxedUint = Option::from(s.invert_mod(&n))?;
+    let u1 = e.mul_mod(&w, &n);
+    let u2 = r.mul_mod(&w, &n);
+    let point = c.add(&c.mul(&u1, &Some(c.g.clone())), &c.mul(&u2, &Some((qx, qy))));
+    // The point at infinity is no valid result (X9.62 §7.4.1 step 5): the signature is wrong.
+    let Some((x, _)) = point else { return Some(false) };
+    Some(x.rem_vartime(&n) == r)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn unhex(s: &str) -> [u8; 64] {
+        let v: Vec<u8> = (0..s.len()).step_by(2).map(|i| u8::from_str_radix(s.get(i..i + 2).unwrap_or("00"), 16).unwrap_or(0)).collect();
+        let mut out = [0u8; 64];
+        out[64 - v.len()..].copy_from_slice(&v);
+        out
+    }
+
+    /// Never-crash: public keys and signature values of any size are refused, not panicked on.
+    #[test]
+    fn hostile_keys_and_signatures_are_refused() {
+        let digest = [7u8; 64];
+        let key = |x: &[u8; 64], y: &[u8; 64]| [&[4u8][..], x, y].concat();
+        let (p, n, gx, gy) = (unhex(P), unhex(N), unhex(GX), unhex(GY));
+        // Coordinates that are not field elements, or not on the curve.
+        for (x, y) in [([0xFF; 64], [0xFF; 64]), (p, [0; 64]), ([0; 64], p), ([0; 64], [0; 64]), (p, p)] {
+            assert_eq!(verify(&key(&x, &y), &digest, &[1u8; 128]), None);
+        }
+        // The generator, a real point, with an r or s that is zero, n, or all ones.
+        for bad in [[0u8; 64], n, [0xFF; 64]] {
+            assert_eq!(verify(&key(&gx, &gy), &digest, &[bad.to_vec(), vec![1; 64]].concat()), Some(false));
+            assert_eq!(verify(&key(&gx, &gy), &digest, &[vec![1; 64], bad.to_vec()].concat()), Some(false));
+        }
+    }
+}
diff --git a/crates/pkcs7/src/keys.rs b/crates/pkcs7/src/keys.rs
new file mode 100644
index 000000000..34cc65e25
--- /dev/null
+++ b/crates/pkcs7/src/keys.rs
@@ -0,0 +1,767 @@
+//! Digests, public keys (verification everywhere) and private keys (signing).
+//!
+//! Verification uses RustCrypto. RSA private-key operations use `aws-lc-rs` on native targets
+//! (constant-time: the `rsa` crate is never used for private keys there). ECDSA
+//! signing uses RustCrypto with deterministic nonces (RFC 6979).
+
+use zeroize::Zeroizing;
+
+use crate::Error;
+use crate::der::{self, Tlv, tag};
+
+pub mod oid {
+    pub const SHA1: &str = "1.3.14.3.2.26";
+    pub const SHA224: &str = "2.16.840.1.101.3.4.2.4";
+    pub const SHA256: &str = "2.16.840.1.101.3.4.2.1";
+    pub const SHA384: &str = "2.16.840.1.101.3.4.2.2";
+    pub const SHA512: &str = "2.16.840.1.101.3.4.2.3";
+    pub const SHA512_224: &str = "2.16.840.1.101.3.4.2.5";
+    pub const SHA512_256: &str = "2.16.840.1.101.3.4.2.6";
+    pub const SHA3_224: &str = "2.16.840.1.101.3.4.2.7";
+    pub const SHA3_256: &str = "2.16.840.1.101.3.4.2.8";
+    pub const SHA3_384: &str = "2.16.840.1.101.3.4.2.9";
+    pub const SHA3_512: &str = "2.16.840.1.101.3.4.2.10";
+    pub const RIPEMD160: &str = "1.3.36.3.2.1";
+    pub const RSA: &str = "1.2.840.113549.1.1.1";
+    pub const RSA_PSS: &str = "1.2.840.113549.1.1.10";
+    pub const MGF1: &str = "1.2.840.113549.1.1.8";
+    pub const EC: &str = "1.2.840.10045.2.1";
+    pub const P256: &str = "1.2.840.10045.3.1.7";
+    pub const P384: &str = "1.3.132.0.34";
+    pub const P521: &str = "1.3.132.0.35";
+    pub const BRAINPOOL_P256: &str = "1.3.36.3.3.2.8.1.1.7";
+    pub const BRAINPOOL_P384: &str = "1.3.36.3.3.2.8.1.1.11";
+    pub const BRAINPOOL_P512: &str = "1.3.36.3.3.2.8.1.1.13";
+    pub const ED25519: &str = "1.3.101.112";
+}
+
+/// Message digests.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum DigestAlg {
+    Sha1,
+    Sha224,
+    Sha256,
+    Sha384,
+    Sha512,
+    Sha512_224,
+    Sha512_256,
+    Sha3_224,
+    Sha3_256,
+    Sha3_384,
+    Sha3_512,
+    Ripemd160,
+}
+
+impl DigestAlg {
+    /// Every digest, for tables.
+    pub const ALL: [DigestAlg; 12] = [
+        DigestAlg::Sha1,
+        DigestAlg::Sha224,
+        DigestAlg::Sha256,
+        DigestAlg::Sha384,
+        DigestAlg::Sha512,
+        DigestAlg::Sha512_224,
+        DigestAlg::Sha512_256,
+        DigestAlg::Sha3_224,
+        DigestAlg::Sha3_256,
+        DigestAlg::Sha3_384,
+        DigestAlg::Sha3_512,
+        DigestAlg::Ripemd160,
+    ];
+
+    pub fn from_oid(o: &str) -> Option<DigestAlg> {
+        DigestAlg::ALL.into_iter().find(|d| d.oid() == o)
+    }
+
+    pub fn oid(self) -> &'static str {
+        match self {
+            DigestAlg::Sha1 => oid::SHA1,
+            DigestAlg::Sha224 => oid::SHA224,
+            DigestAlg::Sha256 => oid::SHA256,
+            DigestAlg::Sha384 => oid::SHA384,
+            DigestAlg::Sha512 => oid::SHA512,
+            DigestAlg::Sha512_224 => oid::SHA512_224,
+            DigestAlg::Sha512_256 => oid::SHA512_256,
+            DigestAlg::Sha3_224 => oid::SHA3_224,
+            DigestAlg::Sha3_256 => oid::SHA3_256,
+            DigestAlg::Sha3_384 => oid::SHA3_384,
+            DigestAlg::Sha3_512 => oid::SHA3_512,
+            DigestAlg::Ripemd160 => oid::RIPEMD160,
+        }
+    }
+
+    pub fn name(self) -> &'static str {
+        match self {
+            DigestAlg::Sha1 => "SHA-1",
+            DigestAlg::Sha224 => "SHA-224",
+            DigestAlg::Sha256 => "SHA-256",
+            DigestAlg::Sha384 => "SHA-384",
+            DigestAlg::Sha512 => "SHA-512",
+            DigestAlg::Sha512_224 => "SHA-512/224",
+            DigestAlg::Sha512_256 => "SHA-512/256",
+            DigestAlg::Sha3_224 => "SHA3-224",
+            DigestAlg::Sha3_256 => "SHA3-256",
+            DigestAlg::Sha3_384 => "SHA3-384",
+            DigestAlg::Sha3_512 => "SHA3-512",
+            DigestAlg::Ripemd160 => "RIPEMD-160",
+        }
+    }
+
+    /// The digest of the concatenation of `parts`.
+    pub fn digest(self, parts: &[&[u8]]) -> Vec<u8> {
+        fn sha2_run<D: sha2::Digest>(parts: &[&[u8]]) -> Vec<u8> {
+            let mut h = D::new();
+            for p in parts {
+                h.update(p);
+            }
+            h.finalize().to_vec()
+        }
+        fn sha3_run<D: sha3::Digest>(parts: &[&[u8]]) -> Vec<u8> {
+            let mut h = D::new();
+            for p in parts {
+                h.update(p);
+            }
+            h.finalize().to_vec()
+        }
+        match self {
+            DigestAlg::Sha1 => sha2_run::<sha1::Sha1>(parts),
+            DigestAlg::Sha224 => sha2_run::<sha2::Sha224>(parts),
+            DigestAlg::Sha256 => sha2_run::<sha2::Sha256>(parts),
+            DigestAlg::Sha384 => sha2_run::<sha2::Sha384>(parts),
+            DigestAlg::Sha512 => sha2_run::<sha2::Sha512>(parts),
+            DigestAlg::Sha512_224 => sha2_run::<sha2::Sha512_224>(parts),
+            DigestAlg::Sha512_256 => sha2_run::<sha2::Sha512_256>(parts),
+            DigestAlg::Sha3_224 => sha3_run::<sha3::Sha3_224>(parts),
+            DigestAlg::Sha3_256 => sha3_run::<sha3::Sha3_256>(parts),
+            DigestAlg::Sha3_384 => sha3_run::<sha3::Sha3_384>(parts),
+            DigestAlg::Sha3_512 => sha3_run::<sha3::Sha3_512>(parts),
+            DigestAlg::Ripemd160 => {
+                use ripemd::Digest;
+                let mut h = ripemd::Ripemd160::new(); // NOSONAR: a digest CMS signatures name; validated, and reported as weak by `weakness`
+                for p in parts {
+                    h.update(p);
+                }
+                h.finalize().to_vec()
+            }
+        }
+    }
+
+    /// What to tell the user when a signature that still validates uses this digest, or `None`
+    /// for one that is fine. Old documents carry SHA-1 and RIPEMD-160, so they validate, but a
+    /// signature panel that showed them like a SHA-256 one would overstate what they prove.
+    pub fn weakness(self) -> Option<&'static str> {
+        match self {
+            DigestAlg::Sha1 => Some(
+                "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.",
+            ),
+            DigestAlg::Ripemd160 => Some(
+                "This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.",
+            ),
+            _ => None,
+        }
+    }
+
+    /// The digest length in bytes.
+    pub fn output_len(self) -> usize {
+        match self {
+            DigestAlg::Sha1 | DigestAlg::Ripemd160 => 20,
+            DigestAlg::Sha224 | DigestAlg::Sha512_224 | DigestAlg::Sha3_224 => 28,
+            DigestAlg::Sha256 | DigestAlg::Sha512_256 | DigestAlg::Sha3_256 => 32,
+            DigestAlg::Sha384 | DigestAlg::Sha3_384 => 48,
+            DigestAlg::Sha512 | DigestAlg::Sha3_512 => 64,
+        }
+    }
+
+    /// The `AlgorithmIdentifier` (no parameters, as RFC 5754 recommends).
+    pub fn algorithm(self) -> Vec<u8> {
+        der::algorithm(self.oid(), None)
+    }
+}
+
+/// RSASSA-PSS parameters (RFC 4055 §3.1) besides the message digest.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct PssParams {
+    /// The MGF1 hash.
+    pub mgf: DigestAlg,
+    /// The declared salt length; `None` recovers it from the signature.
+    pub salt_len: Option<usize>,
+}
+
+/// How a signature value is computed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Scheme {
+    RsaPkcs1,
+    RsaPss(PssParams),
+    /// ECDSA over a digest, the signature DER or plain `r ‖ s`.
+    Ecdsa,
+    /// EdDSA over the message itself (RFC 8419), not over a digest.
+    Ed25519,
+}
+
+/// Signature algorithm OIDs that name both the scheme and the digest.
+const SIGNATURE_OIDS: &[(&str, Scheme, DigestAlg)] = &[
+    ("1.2.840.113549.1.1.5", Scheme::RsaPkcs1, DigestAlg::Sha1),
+    ("1.2.840.113549.1.1.14", Scheme::RsaPkcs1, DigestAlg::Sha224),
+    ("1.2.840.113549.1.1.11", Scheme::RsaPkcs1, DigestAlg::Sha256),
+    ("1.2.840.113549.1.1.12", Scheme::RsaPkcs1, DigestAlg::Sha384),
+    ("1.2.840.113549.1.1.13", Scheme::RsaPkcs1, DigestAlg::Sha512),
+    ("1.2.840.113549.1.1.15", Scheme::RsaPkcs1, DigestAlg::Sha512_224),
+    ("1.2.840.113549.1.1.16", Scheme::RsaPkcs1, DigestAlg::Sha512_256),
+    ("2.16.840.1.101.3.4.3.13", Scheme::RsaPkcs1, DigestAlg::Sha3_224),
+    ("2.16.840.1.101.3.4.3.14", Scheme::RsaPkcs1, DigestAlg::Sha3_256),
+    ("2.16.840.1.101.3.4.3.15", Scheme::RsaPkcs1, DigestAlg::Sha3_384),
+    ("2.16.840.1.101.3.4.3.16", Scheme::RsaPkcs1, DigestAlg::Sha3_512),
+    ("1.3.36.3.3.1.2", Scheme::RsaPkcs1, DigestAlg::Ripemd160),
+    ("1.2.840.10045.4.1", Scheme::Ecdsa, DigestAlg::Sha1),
+    ("1.2.840.10045.4.3.1", Scheme::Ecdsa, DigestAlg::Sha224),
+    ("1.2.840.10045.4.3.2", Scheme::Ecdsa, DigestAlg::Sha256),
+    ("1.2.840.10045.4.3.3", Scheme::Ecdsa, DigestAlg::Sha384),
+    ("1.2.840.10045.4.3.4", Scheme::Ecdsa, DigestAlg::Sha512),
+    ("2.16.840.1.101.3.4.3.9", Scheme::Ecdsa, DigestAlg::Sha3_224),
+    ("2.16.840.1.101.3.4.3.10", Scheme::Ecdsa, DigestAlg::Sha3_256),
+    ("2.16.840.1.101.3.4.3.11", Scheme::Ecdsa, DigestAlg::Sha3_384),
+    ("2.16.840.1.101.3.4.3.12", Scheme::Ecdsa, DigestAlg::Sha3_512),
+    // BSI TR-03111 "plain" ECDSA (r ‖ s), as German signature cards write it.
+    ("0.4.0.127.0.7.1.1.4.1.1", Scheme::Ecdsa, DigestAlg::Sha1),
+    ("0.4.0.127.0.7.1.1.4.1.2", Scheme::Ecdsa, DigestAlg::Sha224),
+    ("0.4.0.127.0.7.1.1.4.1.3", Scheme::Ecdsa, DigestAlg::Sha256),
+    ("0.4.0.127.0.7.1.1.4.1.4", Scheme::Ecdsa, DigestAlg::Sha384),
+    ("0.4.0.127.0.7.1.1.4.1.5", Scheme::Ecdsa, DigestAlg::Sha512),
+    ("0.4.0.127.0.7.1.1.4.1.6", Scheme::Ecdsa, DigestAlg::Ripemd160),
+];
+
+/// A signature `AlgorithmIdentifier`: the scheme and, when the identifier names one, the digest.
+pub fn signature_algorithm(alg: &Tlv<'_>) -> Result<(Scheme, Option<DigestAlg>), Error> {
+    let parts = alg.children()?;
+    let o = parts.first().ok_or_else(|| Error::Malformed("empty algorithm".into()))?.oid()?;
+    if let Some((_, scheme, digest)) = SIGNATURE_OIDS.iter().find(|(k, _, _)| *k == o) {
+        return Ok((*scheme, Some(*digest)));
+    }
+    Ok(match o.as_str() {
+        oid::RSA => (Scheme::RsaPkcs1, None),
+        oid::EC => (Scheme::Ecdsa, None),
+        oid::ED25519 => (Scheme::Ed25519, None),
+        oid::RSA_PSS => {
+            let (hash, params) = pss_params(parts.get(1))?;
+            (Scheme::RsaPss(params), Some(hash))
+        }
+        other => return Err(Error::Unsupported(format!("signature algorithm {other}"))),
+    })
+}
+
+/// `RSASSA-PSS-params` (RFC 4055): `[0]` hash (default SHA-1), `[1]` mask generation function
+/// (default MGF1 with SHA-1), `[2]` salt length (default 20). Absent parameters mean the defaults.
+fn pss_params(params: Option<&Tlv<'_>>) -> Result<(DigestAlg, PssParams), Error> {
+    let hash_of = |alg: &Tlv<'_>| -> Result<DigestAlg, Error> {
+        let o = alg.children()?.first().ok_or_else(|| Error::Malformed("PSS hash".into()))?.oid()?;
+        DigestAlg::from_oid(&o).ok_or_else(|| Error::Unsupported(format!("digest {o}")))
+    };
+    let mut hash = DigestAlg::Sha1;
+    let mut mgf = DigestAlg::Sha1;
+    let mut salt_len = 20usize;
+    if let Some(p) = params.filter(|p| p.tag == tag::SEQUENCE) {
+        for field in p.children()? {
+            match field.tag {
+                t if t == tag::ctx(0) => hash = hash_of(&field.inner()?)?,
+                t if t == tag::ctx(1) => {
+                    let m = field.inner()?.children()?;
+                    if m.first().map(|o| o.oid()).transpose()?.as_deref() != Some(oid::MGF1) {
+                        return Err(Error::Unsupported("PSS mask generation function other than MGF1".into()));
+                    }
+                    mgf = hash_of(m.get(1).ok_or_else(|| Error::Malformed("MGF1 hash".into()))?)?;
+                }
+                t if t == tag::ctx(2) => salt_len = usize::try_from(field.inner()?.u64()?).map_err(|_| Error::Malformed("PSS salt length".into()))?,
+                _ => {}
+            }
+        }
+    }
+    Ok((hash, PssParams { mgf, salt_len: Some(salt_len) }))
+}
+
+/// The length in bits of the RSA modulus `n` (big-endian; leading zero bytes don't count).
+fn rsa_bits(n: &[u8]) -> usize {
+    let n = n.iter().position(|b| *b != 0).and_then(|i| n.get(i..)).unwrap_or_default();
+    n.first().map_or(0, |b| n.len() * 8 - b.leading_zeros() as usize)
+}
+
+/// A public key from a `SubjectPublicKeyInfo`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum PublicKey {
+    Rsa {
+        n: Vec<u8>,
+        e: Vec<u8>,
+    },
+    P256(Vec<u8>),
+    P384(Vec<u8>),
+    /// Verification only (no signing).
+    P521(Vec<u8>),
+    BrainpoolP256(Vec<u8>),
+    BrainpoolP384(Vec<u8>),
+    BrainpoolP512(Vec<u8>),
+    /// The 32-byte public key (RFC 8032). Signs the message itself, see [`Scheme::Ed25519`].
+    Ed25519(Vec<u8>),
+    /// A key algorithm or curve this crate can't check signatures with. The certificate still
+    /// parses (so its name and dates show); verifying with it gives [`Error::Unsupported`].
+    Unsupported {
+        what: String,
+        spki: Vec<u8>,
+    },
+}
+
+/// The private key a platform key store (the Windows certificate store, through CNG) must
+/// hold to sign for a certificate, see [`PublicKey::store_signing_key`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum StoreKey {
+    Rsa,
+    /// ECDSA with a key of this many bits.
+    Ecdsa(u32),
+}
+
+impl PublicKey {
+    /// The `subjectPublicKey` BIT STRING contents — what OCSP's `issuerKeyHash` covers
+    /// (RFC 6960 §4.1.1). RSA keys are re-encoded; EC points are the stored bytes.
+    pub fn key_bits(&self) -> Vec<u8> {
+        match self {
+            PublicKey::Rsa { n, e } => der::seq(&[&der::uint(n), &der::uint(e)]),
+            PublicKey::P256(bits)
+            | PublicKey::P384(bits)
+            | PublicKey::P521(bits)
+            | PublicKey::BrainpoolP256(bits)
+            | PublicKey::BrainpoolP384(bits)
+            | PublicKey::BrainpoolP512(bits)
+            | PublicKey::Ed25519(bits) => bits.clone(),
+            // The BIT STRING of the stored SubjectPublicKeyInfo (empty if it doesn't parse).
+            PublicKey::Unsupported { spki, .. } => Tlv::parse(spki)
+                .ok()
+                .and_then(|(t, _)| t.children().ok())
+                .and_then(|c| c.get(1).and_then(|k| k.bits().ok().map(<[u8]>::to_vec)))
+                .unwrap_or_default(),
+        }
+    }
+
+    pub fn from_spki(spki: &Tlv<'_>) -> Result<PublicKey, Error> {
+        let parts = spki.children()?;
+        let [alg, key] = parts.as_slice() else { return Err(Error::Malformed("SubjectPublicKeyInfo".into())) };
+        let alg = alg.children()?;
+        let o = alg.first().ok_or_else(|| Error::Malformed("key algorithm".into()))?.oid()?;
+        let bits = key.bits()?;
+        match o.as_str() {
+            oid::ED25519 => Ok(PublicKey::Ed25519(bits.to_vec())),
+            oid::RSA => {
+                let k = Tlv::parse_all(bits)?.children()?;
+                let [n, e] = k.as_slice() else { return Err(Error::Malformed("RSAPublicKey".into())) };
+                Ok(PublicKey::Rsa { n: n.uint_bytes().to_vec(), e: e.uint_bytes().to_vec() })
+            }
+            oid::EC => match alg.get(1).map(|c| c.oid()).transpose()?.as_deref() {
+                Some(oid::P256) => Ok(PublicKey::P256(bits.to_vec())),
+                Some(oid::P384) => Ok(PublicKey::P384(bits.to_vec())),
+                Some(oid::P521) => Ok(PublicKey::P521(bits.to_vec())),
+                Some(oid::BRAINPOOL_P256) => Ok(PublicKey::BrainpoolP256(bits.to_vec())),
+                Some(oid::BRAINPOOL_P384) => Ok(PublicKey::BrainpoolP384(bits.to_vec())),
+                Some(oid::BRAINPOOL_P512) => Ok(PublicKey::BrainpoolP512(bits.to_vec())),
+                other => Ok(PublicKey::Unsupported { what: format!("elliptic curve {}", other.unwrap_or("?")), spki: spki.raw.to_vec() }),
+            },
+            other => Ok(PublicKey::Unsupported { what: format!("public key algorithm {other}"), spki: spki.raw.to_vec() }),
+        }
+    }
+
+    /// The `SubjectPublicKeyInfo` encoding.
+    pub fn spki(&self) -> Vec<u8> {
+        match self {
+            PublicKey::Rsa { n, e } => {
+                let rsa = der::seq(&[&der::uint(n), &der::uint(e)]);
+                der::seq(&[&der::algorithm(oid::RSA, Some(&der::null())), &der::bit_string(&rsa)])
+            }
+            PublicKey::P256(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::P256)]), &der::bit_string(p)]),
+            PublicKey::P384(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::P384)]), &der::bit_string(p)]),
+            PublicKey::P521(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::P521)]), &der::bit_string(p)]),
+            PublicKey::BrainpoolP256(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::BRAINPOOL_P256)]), &der::bit_string(p)]),
+            PublicKey::BrainpoolP384(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::BRAINPOOL_P384)]), &der::bit_string(p)]),
+            PublicKey::BrainpoolP512(p) => der::seq(&[&der::seq(&[&der::oid(oid::EC), &der::oid(oid::BRAINPOOL_P512)]), &der::bit_string(p)]),
+            PublicKey::Ed25519(p) => der::seq(&[&der::seq(&[&der::oid(oid::ED25519)]), &der::bit_string(p)]),
+            PublicKey::Unsupported { spki, .. } => spki.clone(),
+        }
+    }
+
+    /// "RSA 2048-bit", "ECDSA P-256"…
+    pub fn describe(&self) -> String {
+        match self {
+            PublicKey::Rsa { n, .. } => format!("RSA {}-bit", rsa_bits(n)),
+            PublicKey::P256(_) => "ECDSA P-256".into(),
+            PublicKey::P384(_) => "ECDSA P-384".into(),
+            PublicKey::P521(_) => "ECDSA P-521".into(),
+            PublicKey::BrainpoolP256(_) => "ECDSA brainpoolP256r1".into(),
+            PublicKey::BrainpoolP384(_) => "ECDSA brainpoolP384r1".into(),
+            PublicKey::BrainpoolP512(_) => "ECDSA brainpoolP512r1".into(),
+            PublicKey::Ed25519(_) => "Ed25519".into(),
+            PublicKey::Unsupported { what, .. } => format!("unsupported ({what})"),
+        }
+    }
+
+    // The two decisions below are what a Windows key-store caller asks of a key. They live here, with every
+    // variant named and no `_` arm, so that a new variant fails to compile on every platform
+    // rather than only in a Windows-only caller.
+
+    /// The key a platform key store must hold to sign for this public key, or `None` when
+    /// this crate doesn't sign with this kind of key (it only verifies P-521, brainpool and
+    /// Ed25519 signatures), so the store's identity is skipped.
+    pub fn store_signing_key(&self) -> Option<StoreKey> {
+        match self {
+            PublicKey::Rsa { .. } => Some(StoreKey::Rsa),
+            PublicKey::P256(_) => Some(StoreKey::Ecdsa(256)),
+            PublicKey::P384(_) => Some(StoreKey::Ecdsa(384)),
+            PublicKey::P521(_)
+            | PublicKey::BrainpoolP256(_)
+            | PublicKey::BrainpoolP384(_)
+            | PublicKey::BrainpoolP512(_)
+            | PublicKey::Ed25519(_)
+            | PublicKey::Unsupported { .. } => None,
+        }
+    }
+
+    /// A key store's signature as a CMS signature carries it: RSA unchanged, ECDSA's fixed-size
+    /// `r ‖ s` (what CNG returns) as a DER `ECDSA-Sig-Value`. Keys [`Self::store_signing_key`]
+    /// rejects give [`Error::Unsupported`].
+    pub fn store_signature_der(&self, raw: &[u8]) -> Result<Vec<u8>, Error> {
+        match self {
+            PublicKey::Rsa { .. } => Ok(raw.to_vec()),
+            PublicKey::P256(_) => p256::ecdsa::Signature::from_slice(raw)
+                .map(|s| s.to_der().as_bytes().to_vec())
+                .map_err(|e| Error::Crypto(format!("the key store returned an invalid P-256 signature: {e}"))),
+            PublicKey::P384(_) => p384::ecdsa::Signature::from_slice(raw)
+                .map(|s| s.to_der().as_bytes().to_vec())
+                .map_err(|e| Error::Crypto(format!("the key store returned an invalid P-384 signature: {e}"))),
+            PublicKey::P521(_)
+            | PublicKey::BrainpoolP256(_)
+            | PublicKey::BrainpoolP384(_)
+            | PublicKey::BrainpoolP512(_)
+            | PublicKey::Ed25519(_)
+            | PublicKey::Unsupported { .. } => Err(Error::Unsupported(format!("signing with {} keys", self.describe()))),
+        }
+    }
+
+    /// Check `sig` over a message whose digest (with `alg`) is `digest`. Encodings are read
+    /// leniently (see [`crate::rsa_pad`], [`ecdsa_rs`]); the cryptographic check never is.
+    /// `Err(Unsupported)` means "can't tell", as opposed to `Ok(false)`: "doesn't match".
+    pub fn verify(&self, scheme: Scheme, alg: DigestAlg, digest: &[u8], sig: &[u8]) -> Result<bool, Error> {
+        self.verify_noting(scheme, alg, digest, sig, &mut Vec::new())
+    }
+
+    /// [`PublicKey::verify`], noting in `notes` each encoding irregularity it tolerated, and a key
+    /// too small to rely on ([`PublicKey::weakness`]). Only meaningful when it returns `Ok(true)`:
+    /// a signature that doesn't verify may leave notes about how far it got.
+    pub fn verify_noting(&self, scheme: Scheme, alg: DigestAlg, digest: &[u8], sig: &[u8], notes: &mut Vec<&'static str>) -> Result<bool, Error> {
+        let verified = self.verify_scheme(scheme, alg, digest, sig, notes);
+        if let Ok(true) = verified
+            && let Some(weak) = self.weakness()
+        {
+            notes.push(weak);
+        }
+        verified
+    }
+
+    /// What to tell the user when a signature that still validates was made with this key, or
+    /// `None` for one that is fine, as [`DigestAlg::weakness`] does for hashes.
+    pub fn weakness(&self) -> Option<&'static str> {
+        match self {
+            PublicKey::Rsa { n, .. } if rsa_bits(n) < 2048 => Some(
+                "This signature uses an RSA key shorter than 2048 bits, which is no longer considered strong enough for signatures. It still validates, but it should not be relied on.",
+            ),
+            _ => None,
+        }
+    }
+
+    fn verify_scheme(&self, scheme: Scheme, alg: DigestAlg, digest: &[u8], sig: &[u8], notes: &mut Vec<&'static str>) -> Result<bool, Error> {
+        match (self, scheme) {
+            (PublicKey::Unsupported { what, .. }, _) => Err(Error::Unsupported(what.clone())),
+            (PublicKey::Rsa { n, e }, Scheme::RsaPkcs1) => crate::rsa_pad::pkcs1_verify(n, e, alg, digest, sig, notes),
+            (PublicKey::Rsa { n, e }, Scheme::RsaPss(params)) => crate::rsa_pad::pss_verify(n, e, alg, params, digest, sig, notes),
+            (PublicKey::Ed25519(_), _) => Err(Error::Unsupported("Ed25519 signs the message, not a digest".into())),
+            (PublicKey::P256(p), Scheme::Ecdsa) => {
+                use p256::ecdsa::signature::hazmat::PrehashVerifier;
+                let key = p256::ecdsa::VerifyingKey::from_sec1_bytes(p).map_err(|_| Error::Malformed("P-256 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 32, notes).and_then(|rs| p256::ecdsa::Signature::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::P384(p), Scheme::Ecdsa) => {
+                use p384::ecdsa::signature::hazmat::PrehashVerifier;
+                let key = p384::ecdsa::VerifyingKey::from_sec1_bytes(p).map_err(|_| Error::Malformed("P-384 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 48, notes).and_then(|rs| p384::ecdsa::Signature::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::P521(p), Scheme::Ecdsa) => {
+                use p521::ecdsa::signature::hazmat::PrehashVerifier;
+                let key = p521::ecdsa::VerifyingKey::from_sec1_bytes(p).map_err(|_| Error::Malformed("P-521 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 66, notes).and_then(|rs| p521::ecdsa::Signature::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::BrainpoolP256(p), Scheme::Ecdsa) => {
+                use ecdsa::signature::hazmat::PrehashVerifier;
+                type Curve = bp256::BrainpoolP256r1;
+                let key = ecdsa::VerifyingKey::<Curve>::from_sec1_bytes(p).map_err(|_| Error::Malformed("brainpoolP256r1 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 32, notes).and_then(|rs| ecdsa::Signature::<Curve>::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::BrainpoolP384(p), Scheme::Ecdsa) => {
+                use ecdsa::signature::hazmat::PrehashVerifier;
+                type Curve = bp384::BrainpoolP384r1;
+                let key = ecdsa::VerifyingKey::<Curve>::from_sec1_bytes(p).map_err(|_| Error::Malformed("brainpoolP384r1 key".into()))?;
+                let Some(s) = ecdsa_rs(sig, 48, notes).and_then(|rs| ecdsa::Signature::<Curve>::from_slice(&rs).ok()) else { return Ok(false) };
+                Ok(key.verify_prehash(digest, &s).is_ok())
+            }
+            (PublicKey::BrainpoolP512(p), Scheme::Ecdsa) => {
+                let Some(rs) = ecdsa_rs(sig, 64, notes) else { return Ok(false) };
+                crate::ec512::verify(p, digest, &rs).ok_or_else(|| Error::Malformed("brainpoolP512r1 key or signature".into()))
+            }
+            _ => Ok(false),
+        }
+    }
+
+    /// Check `sig` over `msg` itself, for the schemes that don't sign a digest (Ed25519,
+    /// RFC 8419: with signed attributes, the message is their DER encoding).
+    pub fn verify_message(&self, scheme: Scheme, msg: &[u8], sig: &[u8]) -> Result<bool, Error> {
+        match (self, scheme) {
+            (PublicKey::Unsupported { what, .. }, _) => Err(Error::Unsupported(what.clone())),
+            (PublicKey::Ed25519(k), Scheme::Ed25519) => {
+                let bytes: [u8; 32] = k.as_slice().try_into().map_err(|_| Error::Malformed("Ed25519 key".into()))?;
+                let key = ed25519_dalek::VerifyingKey::from_bytes(&bytes).map_err(|_| Error::Malformed("Ed25519 key".into()))?;
+                let Ok(sig) = ed25519_dalek::Signature::from_slice(sig) else { return Ok(false) };
+                Ok(key.verify_strict(msg, &sig).is_ok())
+            }
+            _ => Ok(false),
+        }
+    }
+}
+
+/// An ECDSA signature as the fixed-width `r ‖ s` the curve crates read: from the standard DER
+/// `SEQUENCE { INTEGER r, INTEGER s }` (also with integers that have redundant leading zeros or
+/// the sign byte missing), or already raw `r ‖ s` as PKCS #11 tokens return it. `notes` gets an
+/// entry when the signature was not canonical DER.
+fn ecdsa_rs(sig: &[u8], field_len: usize, notes: &mut Vec<&'static str>) -> Option<Vec<u8>> {
+    let pad = |int: &[u8]| -> Option<Vec<u8>> {
+        let int = int.get(int.iter().position(|b| *b != 0).unwrap_or(int.len())..).unwrap_or_default();
+        let zeros = field_len.checked_sub(int.len())?;
+        Some(std::iter::repeat_n(0u8, zeros).chain(int.iter().copied()).collect())
+    };
+    if let Ok((t, rest)) = Tlv::parse(sig)
+        && t.tag == tag::SEQUENCE
+        && rest.iter().all(|b| *b == 0)
+        && let Ok(parts) = t.children()
+        && let [r, s] = parts.as_slice()
+        && r.tag == tag::INTEGER
+        && s.tag == tag::INTEGER
+    {
+        // Canonical DER: nothing after the sequence, minimal positive integers.
+        let minimal = |i: &Tlv<'_>| i.value.first().is_some_and(|b| b & 0x80 == 0) && !matches!(i.value, [0, b, ..] if b & 0x80 == 0);
+        if !rest.is_empty() || !minimal(r) || !minimal(s) {
+            notes.push("The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.");
+        }
+        let mut out = pad(r.value)?;
+        out.extend(pad(s.value)?);
+        return Some(out);
+    }
+    (sig.len() == field_len * 2).then(|| {
+        notes.push("The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.");
+        sig.to_vec()
+    })
+}
+
+enum Inner {
+    #[cfg(not(target_arch = "wasm32"))]
+    Rsa(aws_lc_rs::signature::RsaKeyPair),
+    #[cfg(target_arch = "wasm32")]
+    Rsa,
+    P256(p256::ecdsa::SigningKey),
+    P384(p384::ecdsa::SigningKey),
+    /// A key held elsewhere (the macOS Keychain, a token) that signs on request.
+    External(std::sync::Arc<dyn ExternalKey>),
+}
+
+/// A private key this crate can't read, only ask to sign (OS key stores, tokens).
+pub trait ExternalKey: Send + Sync {
+    /// Sign `msg`, hashing it with `alg` (PKCS #1 v1.5 for RSA, DER-encoded ECDSA).
+    fn sign(&self, alg: DigestAlg, msg: &[u8]) -> Result<Vec<u8>, Error>;
+}
+
+/// A private key that can sign.
+pub struct PrivateKey {
+    inner: Inner,
+    public: PublicKey,
+    /// The PKCS#8 `PrivateKeyInfo` it came from (to write it back into a PKCS#12 file).
+    pub(crate) pkcs8: Zeroizing<Vec<u8>>,
+}
+
+impl std::fmt::Debug for PrivateKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "PrivateKey({})", self.public.describe())
+    }
+}
+
+impl PrivateKey {
+    /// A key held outside this process's memory (its public half is `public`). It can't be
+    /// exported to a PKCS #12 file.
+    pub fn external(public: PublicKey, key: std::sync::Arc<dyn ExternalKey>) -> PrivateKey {
+        PrivateKey { inner: Inner::External(key), public, pkcs8: Zeroizing::new(Vec::new()) }
+    }
+
+    /// Whether the key lives outside the app (and so can't be exported).
+    pub fn is_external(&self) -> bool {
+        matches!(self.inner, Inner::External(_))
+    }
+
+    /// From a PKCS#8 `PrivateKeyInfo`.
+    pub fn from_pkcs8(info: &[u8]) -> Result<PrivateKey, Error> {
+        let t = Tlv::parse_all(info)?.children()?;
+        let [_version, alg, key, ..] = t.as_slice() else { return Err(Error::Malformed("PrivateKeyInfo".into())) };
+        let alg = alg.children()?;
+        let o = alg.first().ok_or_else(|| Error::Malformed("key algorithm".into()))?.oid()?;
+        let key = key.expect(tag::OCTET_STRING, "private key")?;
+        match o.as_str() {
+            oid::RSA => {
+                let k = Tlv::parse_all(key.value)?.children()?;
+                let (n, e) = match k.as_slice() {
+                    [_, n, e, ..] => (n.uint_bytes().to_vec(), e.uint_bytes().to_vec()),
+                    _ => return Err(Error::Malformed("RSAPrivateKey".into())),
+                };
+                #[cfg(not(target_arch = "wasm32"))]
+                let inner = Inner::Rsa(
+                    aws_lc_rs::signature::RsaKeyPair::from_pkcs8(info)
+                        .or_else(|_| aws_lc_rs::signature::RsaKeyPair::from_der(key.value))
+                        .map_err(|e| Error::Malformed(format!("RSA private key: {e}")))?,
+                );
+                #[cfg(target_arch = "wasm32")]
+                let inner = Inner::Rsa;
+                Ok(PrivateKey { inner, public: PublicKey::Rsa { n, e }, pkcs8: Zeroizing::new(info.to_vec()) })
+            }
+            oid::EC => {
+                // ECPrivateKey: version, privateKey OCTET STRING, [0] parameters, [1] publicKey.
+                let ec = Tlv::parse_all(key.value)?.children()?;
+                let d = ec.get(1).ok_or_else(|| Error::Malformed("ECPrivateKey".into()))?.expect(tag::OCTET_STRING, "EC private key")?.value;
+                let curve = match alg.get(1).map(|c| c.oid()).transpose()? {
+                    Some(c) => c,
+                    None => ec
+                        .iter()
+                        .find(|t| t.tag == tag::ctx(0))
+                        .and_then(|p| p.inner().ok())
+                        .and_then(|p| p.oid().ok())
+                        .ok_or_else(|| Error::Malformed("EC curve".into()))?,
+                };
+                match curve.as_str() {
+                    oid::P256 => {
+                        let k = p256::ecdsa::SigningKey::from_slice(d).map_err(|_| Error::Malformed("P-256 key".into()))?;
+                        let public = PublicKey::P256(k.verifying_key().to_sec1_point(false).as_bytes().to_vec());
+                        Ok(PrivateKey { inner: Inner::P256(k), public, pkcs8: Zeroizing::new(info.to_vec()) })
+                    }
+                    oid::P384 => {
+                        let k = p384::ecdsa::SigningKey::from_slice(d).map_err(|_| Error::Malformed("P-384 key".into()))?;
+                        let public = PublicKey::P384(k.verifying_key().to_sec1_point(false).as_bytes().to_vec());
+                        Ok(PrivateKey { inner: Inner::P384(k), public, pkcs8: Zeroizing::new(info.to_vec()) })
+                    }
+                    other => Err(Error::Unsupported(format!("elliptic curve {other}"))),
+                }
+            }
+            other => Err(Error::Unsupported(format!("private key algorithm {other}"))),
+        }
+    }
+
+    /// A new RSA key (Acrobat's default for a self-signed digital ID is 2048-bit RSA).
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn generate_rsa(bits: usize) -> Result<PrivateKey, Error> {
+        use aws_lc_rs::encoding::AsDer;
+        use aws_lc_rs::rsa::KeySize;
+        let size = match bits {
+            2048 => KeySize::Rsa2048,
+            3072 => KeySize::Rsa3072,
+            4096 => KeySize::Rsa4096,
+            _ => return Err(Error::Unsupported(format!("{bits}-bit RSA keys"))),
+        };
+        let kp = aws_lc_rs::signature::RsaKeyPair::generate(size).map_err(|_| Error::Crypto("RSA key generation failed".into()))?;
+        let der = kp.as_der().map_err(|_| Error::Crypto("RSA key encoding failed".into()))?;
+        PrivateKey::from_pkcs8(der.as_ref())
+    }
+
+    /// RSA keys are generated only on native targets.
+    #[cfg(target_arch = "wasm32")]
+    pub fn generate_rsa(_bits: usize) -> Result<PrivateKey, Error> {
+        Err(Error::Unsupported("creating RSA keys in the browser (use a P-256 key)".into()))
+    }
+
+    /// A new P-256 key.
+    pub fn generate_p256() -> Result<PrivateKey, Error> {
+        loop {
+            let mut d = Zeroizing::new([0u8; 32]);
+            getrandom::fill(&mut *d).map_err(|e| Error::Crypto(format!("no randomness: {e}")))?;
+            if let Ok(k) = p256::ecdsa::SigningKey::from_slice(&*d) {
+                let point = k.verifying_key().to_sec1_point(false).as_bytes().to_vec();
+                // PKCS#8 with an ECPrivateKey (RFC 5915) carrying the public key.
+                let d_octets = Zeroizing::new(der::octets(&*d));
+                let ec = Zeroizing::new(der::seq(&[&der::int(1), &d_octets, &der::explicit(1, &der::bit_string(&point))]));
+                let ec_octets = Zeroizing::new(der::octets(&ec));
+                let info = Zeroizing::new(der::seq(&[&der::int(0), &der::seq(&[&der::oid(oid::EC), &der::oid(oid::P256)]), &ec_octets]));
+                return PrivateKey::from_pkcs8(&info);
+            }
+        }
+    }
+
+    pub fn public_key(&self) -> &PublicKey {
+        &self.public
+    }
+
+    pub fn pkcs8(&self) -> &[u8] {
+        &self.pkcs8
+    }
+
+    /// The signature `AlgorithmIdentifier` this key writes with `alg`.
+    pub fn signature_algorithm(&self, alg: DigestAlg) -> Vec<u8> {
+        let rsa = matches!(self.public, PublicKey::Rsa { .. });
+        let scheme = if rsa { Scheme::RsaPkcs1 } else { Scheme::Ecdsa };
+        // `sign` only writes SHA-256/384/512, which the table has for both schemes.
+        let oid = SIGNATURE_OIDS
+            .iter()
+            .find(|(_, s, d)| *s == scheme && *d == alg)
+            .map_or(if rsa { "1.2.840.113549.1.1.11" } else { "1.2.840.10045.4.3.2" }, |(o, _, _)| *o);
+        der::algorithm(oid, rsa.then(der::null).as_deref())
+    }
+
+    /// The digest a signature with this key should use: SHA-256, or SHA-384 for P-384.
+    pub fn preferred_digest(&self) -> DigestAlg {
+        match self.public {
+            PublicKey::P384(_) => DigestAlg::Sha384,
+            _ => DigestAlg::Sha256,
+        }
+    }
+
+    /// Sign `msg` (hashed with `alg`). New signatures never use SHA-1.
+    pub fn sign(&self, alg: DigestAlg, msg: &[u8]) -> Result<Vec<u8>, Error> {
+        if !matches!(alg, DigestAlg::Sha256 | DigestAlg::Sha384 | DigestAlg::Sha512) {
+            return Err(Error::Unsupported(format!("{} for new signatures", alg.name())));
+        }
+        match &self.inner {
+            #[cfg(not(target_arch = "wasm32"))]
+            Inner::Rsa(kp) => {
+                use aws_lc_rs::signature::{RSA_PKCS1_SHA256, RSA_PKCS1_SHA384, RSA_PKCS1_SHA512};
+                let enc: &'static dyn aws_lc_rs::signature::RsaEncoding = match alg {
+                    DigestAlg::Sha384 => &RSA_PKCS1_SHA384,
+                    DigestAlg::Sha512 => &RSA_PKCS1_SHA512,
+                    _ => &RSA_PKCS1_SHA256,
+                };
+                let mut sig = vec![0u8; kp.public_modulus_len()];
+                kp.sign(enc, &aws_lc_rs::rand::SystemRandom::new(), msg, &mut sig).map_err(|_| Error::Crypto("RSA signing failed".into()))?;
+                Ok(sig)
+            }
+            #[cfg(target_arch = "wasm32")]
+            Inner::Rsa => Err(Error::Unsupported("RSA signing in the browser".into())),
+            Inner::P256(k) => {
+                use p256::ecdsa::signature::hazmat::PrehashSigner;
+                let s: p256::ecdsa::Signature = k.sign_prehash(&alg.digest(&[msg])).map_err(|e| Error::Crypto(e.to_string()))?;
+                Ok(s.to_der().as_bytes().to_vec())
+            }
+            Inner::External(k) => k.sign(alg, msg),
+            Inner::P384(k) => {
+                use p384::ecdsa::signature::hazmat::PrehashSigner;
+                let s: p384::ecdsa::Signature = k.sign_prehash(&alg.digest(&[msg])).map_err(|e| Error::Crypto(e.to_string()))?;
+                Ok(s.to_der().as_bytes().to_vec())
+            }
+        }
+    }
+}
diff --git a/crates/pkcs7/src/lib.rs b/crates/pkcs7/src/lib.rs
new file mode 100644
index 000000000..776be2749
--- /dev/null
+++ b/crates/pkcs7/src/lib.rs
@@ -0,0 +1,56 @@
+//! The formats of digital signatures: ASN.1 DER, X.509 certificates, CMS SignedData (PKCS #7),
+//! PKCS #12 identity files, RFC 3161 timestamps, and CRL / OCSP revocation evidence.
+//!
+//! - [`der`]: a small BER/DER reader and writer; a [`der::Tlv`] keeps its exact encoding, so
+//!   signed structures are verified over the bytes that were signed.
+//! - [`x509`]: certificates (RFC 5280), the checks along a chain of issuers, certificate files
+//!   (DER, PEM, PKCS #7 bundles), and a self-signed certificate builder.
+//! - [`cms`]: CMS SignedData (RFC 5652), parsed, verified and written (detached, or with the
+//!   content encapsulated), with RFC 3161 tokens attached as unsigned attributes.
+//! - [`pkcs12`]: `.p12` / `.pfx` files (RFC 7292), read and written, with the key-derivation
+//!   work a file may ask for capped.
+//! - [`timestamp`]: RFC 3161 requests, responses and tokens. No transport.
+//! - [`revocation`]: CRLs and OCSP responses, parsed, verified and looked up. Nothing is fetched.
+//! - [`keys`]: digests, public keys (verification) and private keys (signing).
+//!
+//! The cryptography is RustCrypto's, and aws-lc-rs's for RSA private-key operations on native
+//! targets. Two things are done here because no audited crate offers them, both verification
+//! only and on public data: the RSA signature paddings for any digest, MGF1 hash and salt
+//! length (over the `rsa` crate's raw public-key operation), and ECDSA on brainpoolP512r1.
+//!
+//! What a signature means for a document or a message (which bytes it covers, what changed
+//! after it, whom the reader trusts) is the caller's.
+//!
+//! Input is hostile: nesting is bounded, lengths are checked against what is there, and
+//! nothing here panics on any bytes.
+
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+pub mod cms;
+pub mod der;
+mod ec512;
+pub mod keys;
+pub mod pkcs12;
+pub mod revocation;
+mod rsa_pad;
+pub mod timestamp;
+pub mod x509;
+
+pub use der::Time;
+pub use keys::{DigestAlg, PrivateKey, PublicKey};
+pub use pkcs12::DigitalId;
+pub use timestamp::{TimestampAuthority, TimestampQuery, TimestampToken};
+pub use x509::{Certificate, Name};
+
+/// What went wrong reading, checking or writing one of these formats.
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("malformed data: {0}")]
+    Malformed(String),
+    #[error("not supported: {0}")]
+    Unsupported(String),
+    #[error("the password is incorrect")]
+    WrongPassword,
+    #[error("{0}")]
+    Crypto(String),
+}
diff --git a/crates/pkcs7/src/pkcs12.rs b/crates/pkcs7/src/pkcs12.rs
new file mode 100644
index 000000000..f14b2297e
--- /dev/null
+++ b/crates/pkcs7/src/pkcs12.rs
@@ -0,0 +1,561 @@
+//! PKCS #12 digital ID files (RFC 7292): `.p12` / `.pfx`, as Acrobat, OpenSSL, macOS Keychain
+//! and Windows export them.
+//!
+//! Reading supports PBES2 (PBKDF2 with HMAC-SHA-1/256/384/512; AES-128/192/256-CBC or
+//! 3DES-CBC) and the legacy PKCS #12 PBE schemes (SHA-1 with 3DES or RC2), and checks the MAC.
+//! Files that aren't clean DER still open: trailing whitespace, PEM armour or a bare
+//! base64 body.
+//! Writing uses PBES2 AES-256-CBC with PBKDF2-HMAC-SHA-256 and an HMAC-SHA-256 MAC, OpenSSL 3's
+//! algorithms, at [`WRITE_ROUNDS`] rather than OpenSSL's 2048. Opening stops at a fixed amount
+//! of key-derivation work, whatever the file asks for.
+//!
+//! The envelope is read as BER, not DER: Windows writes `.p12` files with indefinite lengths and
+//! the AuthenticatedSafe split into OCTET STRING segments, and nothing in the envelope is signed
+//! over its own bytes. The certificates inside it are still read as strict DER, which is how they
+//! were signed.
+
+use std::borrow::Cow;
+
+use base64::Engine as _;
+use cbc::cipher::block_padding::Pkcs7;
+use cbc::cipher::{BlockModeDecrypt, BlockModeEncrypt, InnerIvInit, KeyIvInit};
+use hmac::Mac;
+use zeroize::Zeroizing;
+
+use crate::Error;
+use crate::der::{self, Tlv, tag};
+use crate::keys::{DigestAlg, PrivateKey};
+use crate::x509::Certificate;
+
+const DATA: &str = "1.2.840.113549.1.7.1";
+const ENCRYPTED_DATA: &str = "1.2.840.113549.1.7.6";
+const KEY_BAG: &str = "1.2.840.113549.1.12.10.1.1";
+const SHROUDED_KEY_BAG: &str = "1.2.840.113549.1.12.10.1.2";
+const CERT_BAG: &str = "1.2.840.113549.1.12.10.1.3";
+const X509_CERT: &str = "1.2.840.113549.1.9.22.1";
+const FRIENDLY_NAME: &str = "1.2.840.113549.1.9.20";
+const LOCAL_KEY_ID: &str = "1.2.840.113549.1.9.21";
+const PBES2: &str = "1.2.840.113549.1.5.13";
+const PBKDF2: &str = "1.2.840.113549.1.5.12";
+const HMAC_SHA1: &str = "1.2.840.113549.2.7";
+const HMAC_SHA256: &str = "1.2.840.113549.2.9";
+const HMAC_SHA384: &str = "1.2.840.113549.2.10";
+const HMAC_SHA512: &str = "1.2.840.113549.2.11";
+const AES128_CBC: &str = "2.16.840.1.101.3.4.1.2";
+const AES192_CBC: &str = "2.16.840.1.101.3.4.1.22";
+const AES256_CBC: &str = "2.16.840.1.101.3.4.1.42";
+const DES_EDE3_CBC: &str = "1.2.840.113549.3.7";
+const PBE_SHA_3DES: &str = "1.2.840.113549.1.12.1.3";
+const PBE_SHA_2DES: &str = "1.2.840.113549.1.12.1.4";
+const PBE_SHA_RC2_128: &str = "1.2.840.113549.1.12.1.5";
+const PBE_SHA_RC2_40: &str = "1.2.840.113549.1.12.1.6";
+
+/// Key-derivation rounds for new files: OWASP's figure for PBKDF2-HMAC-SHA-256. The MAC uses the
+/// same count, because checking it alone tells whether a guessed password is right.
+pub const WRITE_ROUNDS: u32 = 600_000;
+
+/// The shortest password a new digital ID may have (NIST SP 800-63B). Opening an existing file
+/// takes any password, so nobody is locked out of an ID made before this minimum.
+pub const MIN_PASSWORD_CHARS: usize = 8;
+
+/// The most key-derivation work one [`open`] does, in hash blocks summed over every derivation
+/// in the file. The file names its own iteration counts, so without a budget a crafted file
+/// hangs the caller on the password check. A file written by [`write`] needs about
+/// 2 million; real files from other tools need far less.
+const OPEN_BUDGET: u64 = 10_000_000;
+
+/// What is left of [`OPEN_BUDGET`] while one file is opened.
+struct Budget(u64);
+
+impl Budget {
+    /// Spend `rounds` iterations to derive `len` bytes with `alg`, and return them as the `u32`
+    /// the derivation takes, or refuse the file if the budget runs out.
+    fn spend(&mut self, alg: DigestAlg, rounds: u64, len: usize) -> Result<u32, Error> {
+        // Every derivation hashes at least once, and repeats the rounds for each output block.
+        let blocks = len.div_ceil(alg.digest(&[]).len().max(1)).max(1) as u64;
+        let cost = rounds.max(1).saturating_mul(blocks);
+        match (self.0.checked_sub(cost), u32::try_from(rounds)) {
+            (Some(left), Ok(rounds)) => {
+                self.0 = left;
+                Ok(rounds)
+            }
+            _ => Err(Error::Unsupported(format!("PKCS #12 files that need more than {OPEN_BUDGET} rounds of key derivation ({rounds} asked for)"))),
+        }
+    }
+}
+
+/// What a digital ID file holds: the signing key, its certificate and any others (issuers).
+#[derive(Debug)]
+pub struct DigitalId {
+    pub key: PrivateKey,
+    pub certificate: Certificate,
+    /// The other certificates in the file (the chain), without the signer's.
+    pub chain: Vec<Certificate>,
+    pub friendly_name: Option<String>,
+}
+
+fn bad(what: &str) -> Error {
+    Error::Malformed(format!("PKCS #12: {what}"))
+}
+
+/// The password as a BMPString with its terminating NUL (RFC 7292 Appendix B.1).
+fn bmp(password: &str) -> Zeroizing<Vec<u8>> {
+    let mut v = Zeroizing::new(password.encode_utf16().flat_map(u16::to_be_bytes).collect::<Vec<u8>>());
+    v.extend([0, 0]);
+    v
+}
+
+/// The PKCS #12 key derivation function (RFC 7292 Appendix B.2).
+fn pkcs12_kdf(alg: DigestAlg, password: &[u8], salt: &[u8], id: u8, iterations: u32, n: usize) -> Zeroizing<Vec<u8>> {
+    // Callers only pass the SHA-1/SHA-2 digests PKCS #12 files use (`open` restricts the MAC digest).
+    let (u, v) = match alg {
+        DigestAlg::Sha1 => (20, 64),
+        DigestAlg::Sha224 => (28, 64),
+        DigestAlg::Sha256 => (32, 64),
+        DigestAlg::Sha384 => (48, 128),
+        DigestAlg::Sha512 => (64, 128),
+        _ => return Zeroizing::new(Vec::new()),
+    };
+    let _ = u;
+    let fill = |s: &[u8]| -> Zeroizing<Vec<u8>> {
+        if s.is_empty() {
+            return Zeroizing::new(Vec::new());
+        }
+        let len = v * s.len().div_ceil(v);
+        Zeroizing::new(s.iter().cycle().take(len).copied().collect())
+    };
+    let d = vec![id; v];
+    let mut i = Zeroizing::new([fill(salt).as_slice(), fill(password).as_slice()].concat());
+    let mut out = Zeroizing::new(Vec::with_capacity(n));
+    while out.len() < n {
+        let mut a = Zeroizing::new(alg.digest(&[&d, &i]));
+        for _ in 1..iterations.max(1) {
+            a = Zeroizing::new(alg.digest(&[&a]));
+        }
+        let b = Zeroizing::new(a.iter().cycle().take(v).copied().collect::<Vec<u8>>());
+        for chunk in i.chunks_mut(v) {
+            // chunk = (chunk + b + 1) mod 2^(8v)
+            let mut carry = 1u16;
+            for k in (0..v).rev() {
+                let s = chunk[k] as u16 + b[k] as u16 + carry;
+                chunk[k] = s as u8;
+                carry = s >> 8;
+            }
+        }
+        out.extend_from_slice(&a);
+    }
+    out.truncate(n);
+    out
+}
+
+#[derive(Clone, Copy)]
+enum Cipher {
+    Aes128,
+    Aes192,
+    Aes256,
+    TripleDes,
+    Rc2(usize),
+}
+
+impl Cipher {
+    fn key_len(self) -> usize {
+        match self {
+            Cipher::Aes128 => 16,
+            Cipher::Aes192 => 24,
+            Cipher::Aes256 => 32,
+            Cipher::TripleDes => 24,
+            Cipher::Rc2(bits) => bits / 8,
+        }
+    }
+
+    fn decrypt(self, key: &[u8], iv: &[u8], ct: &[u8]) -> Result<Zeroizing<Vec<u8>>, Error> {
+        let wrong = || Error::WrongPassword;
+        let r = match self {
+            Cipher::Aes128 => cbc::Decryptor::<aes::Aes128>::new_from_slices(key, iv).map_err(|_| wrong())?.decrypt_padded_vec::<Pkcs7>(ct),
+            Cipher::Aes192 => cbc::Decryptor::<aes::Aes192>::new_from_slices(key, iv).map_err(|_| wrong())?.decrypt_padded_vec::<Pkcs7>(ct),
+            Cipher::Aes256 => cbc::Decryptor::<aes::Aes256>::new_from_slices(key, iv).map_err(|_| wrong())?.decrypt_padded_vec::<Pkcs7>(ct),
+            Cipher::TripleDes => cbc::Decryptor::<des::TdesEde3>::new_from_slices(key, iv).map_err(|_| wrong())?.decrypt_padded_vec::<Pkcs7>(ct),
+            Cipher::Rc2(bits) => {
+                let c = rc2::Rc2::new_with_eff_key_len(key, bits);
+                cbc::Decryptor::<rc2::Rc2>::inner_iv_slice_init(c, iv).map_err(|_| wrong())?.decrypt_padded_vec::<Pkcs7>(ct)
+            }
+        };
+        r.map(Zeroizing::new).map_err(|_| wrong())
+    }
+}
+
+fn hmac(alg: DigestAlg, key: &[u8], data: &[u8]) -> Result<Vec<u8>, Error> {
+    fn run<D: hmac::EagerHash>(key: &[u8], data: &[u8]) -> Result<Vec<u8>, Error>
+    where
+        hmac::Hmac<D>: hmac::KeyInit + Mac,
+    {
+        // HMAC takes any key length, so this never fails in practice.
+        let mut m = <hmac::Hmac<D> as hmac::KeyInit>::new_from_slice(key).map_err(|_| bad("MAC key"))?;
+        m.update(data);
+        Ok(m.finalize().into_bytes().to_vec())
+    }
+    match alg {
+        DigestAlg::Sha1 => run::<sha1::Sha1>(key, data),
+        DigestAlg::Sha224 => run::<sha2::Sha224>(key, data),
+        DigestAlg::Sha256 => run::<sha2::Sha256>(key, data),
+        DigestAlg::Sha384 => run::<sha2::Sha384>(key, data),
+        DigestAlg::Sha512 => run::<sha2::Sha512>(key, data),
+        other => Err(Error::Unsupported(format!("{} in a PKCS #12 MAC", other.name()))),
+    }
+}
+
+fn pbkdf2(prf: DigestAlg, password: &[u8], salt: &[u8], rounds: u32, len: usize) -> Result<Zeroizing<Vec<u8>>, Error> {
+    let mut out = Zeroizing::new(vec![0u8; len]);
+    match prf {
+        DigestAlg::Sha1 => pbkdf2::pbkdf2_hmac::<sha1::Sha1>(password, salt, rounds, &mut out),
+        DigestAlg::Sha224 => pbkdf2::pbkdf2_hmac::<sha2::Sha224>(password, salt, rounds, &mut out),
+        DigestAlg::Sha256 => pbkdf2::pbkdf2_hmac::<sha2::Sha256>(password, salt, rounds, &mut out),
+        DigestAlg::Sha384 => pbkdf2::pbkdf2_hmac::<sha2::Sha384>(password, salt, rounds, &mut out),
+        DigestAlg::Sha512 => pbkdf2::pbkdf2_hmac::<sha2::Sha512>(password, salt, rounds, &mut out),
+        other => return Err(Error::Unsupported(format!("PBKDF2 with {}", other.name()))),
+    }
+    Ok(out)
+}
+
+/// Decrypt `ct` with the password-based scheme `alg` (an AlgorithmIdentifier).
+fn pbe_decrypt(alg: &Tlv<'_>, password: &str, ct: &[u8], budget: &mut Budget) -> Result<Zeroizing<Vec<u8>>, Error> {
+    let parts = alg.children()?;
+    let o = parts.first().ok_or_else(|| bad("algorithm"))?.oid()?;
+    let params = parts.get(1).ok_or_else(|| bad("algorithm parameters"))?;
+    match o.as_str() {
+        PBES2 => {
+            let p = params.children()?;
+            let [kdf, scheme] = p.as_slice() else { return Err(bad("PBES2 parameters")) };
+            let kdf = kdf.children()?;
+            if kdf.first().map(|o| o.oid()).transpose()?.as_deref() != Some(PBKDF2) {
+                return Err(Error::Unsupported("PBES2 key derivation other than PBKDF2".into()));
+            }
+            let kp = kdf.get(1).ok_or_else(|| bad("PBKDF2 parameters"))?.children()?;
+            let salt = kp.first().ok_or_else(|| bad("salt"))?.octets("salt")?;
+            let rounds = kp.get(1).ok_or_else(|| bad("iterations"))?.u64()?;
+            let prf = match kp
+                .iter()
+                .skip(2)
+                .find(|t| t.tag == tag::SEQUENCE)
+                .and_then(|a| a.children().ok())
+                .and_then(|a| a.first().and_then(|o| o.oid().ok()))
+            {
+                None => DigestAlg::Sha1,
+                Some(o) => match o.as_str() {
+                    HMAC_SHA1 => DigestAlg::Sha1,
+                    HMAC_SHA256 => DigestAlg::Sha256,
+                    HMAC_SHA384 => DigestAlg::Sha384,
+                    HMAC_SHA512 => DigestAlg::Sha512,
+                    other => return Err(Error::Unsupported(format!("PBKDF2 PRF {other}"))),
+                },
+            };
+            let sc = scheme.children()?;
+            let cipher = match sc.first().map(|o| o.oid()).transpose()?.as_deref() {
+                Some(AES128_CBC) => Cipher::Aes128,
+                Some(AES192_CBC) => Cipher::Aes192,
+                Some(AES256_CBC) => Cipher::Aes256,
+                Some(DES_EDE3_CBC) => Cipher::TripleDes,
+                other => return Err(Error::Unsupported(format!("PBES2 cipher {}", other.unwrap_or("?")))),
+            };
+            let iv = sc.get(1).ok_or_else(|| bad("IV"))?.octets("IV")?;
+            let rounds = budget.spend(prf, rounds, cipher.key_len())?;
+            let key = pbkdf2(prf, password.as_bytes(), &salt, rounds, cipher.key_len())?;
+            cipher.decrypt(&key, &iv, ct)
+        }
+        PBE_SHA_3DES | PBE_SHA_2DES | PBE_SHA_RC2_128 | PBE_SHA_RC2_40 => {
+            let p = params.children()?;
+            let salt = p.first().ok_or_else(|| bad("salt"))?.octets("salt")?;
+            let rounds = p.get(1).ok_or_else(|| bad("iterations"))?.u64()?;
+            let (cipher, key_len, iv_len) = match o.as_str() {
+                PBE_SHA_3DES => (Cipher::TripleDes, 24, 8),
+                PBE_SHA_2DES => (Cipher::TripleDes, 16, 8),
+                PBE_SHA_RC2_128 => (Cipher::Rc2(128), 16, 8),
+                _ => (Cipher::Rc2(40), 5, 8),
+            };
+            let pw = bmp(password);
+            // Two derivations from the same count: the key, then the IV.
+            let rounds = budget.spend(DigestAlg::Sha1, rounds, key_len)?;
+            budget.spend(DigestAlg::Sha1, u64::from(rounds), iv_len)?;
+            let mut key = pkcs12_kdf(DigestAlg::Sha1, &pw, &salt, 1, rounds, key_len);
+            if key.len() == 16 && matches!(cipher, Cipher::TripleDes) {
+                // Two-key 3DES: K1 K2 K1.
+                key.extend_from_within(..8);
+            }
+            let iv = pkcs12_kdf(DigestAlg::Sha1, &pw, &salt, 2, rounds, iv_len);
+            cipher.decrypt(&key, &iv, ct)
+        }
+        other => Err(Error::Unsupported(format!("PKCS #12 encryption {other}"))),
+    }
+}
+
+struct Bag {
+    kind: BagKind,
+    local_key_id: Option<Vec<u8>>,
+    friendly_name: Option<String>,
+}
+
+enum BagKind {
+    Key(Zeroizing<Vec<u8>>),
+    Cert(Vec<u8>),
+}
+
+fn bags(safe_contents: &[u8], password: &str, out: &mut Vec<Bag>, budget: &mut Budget) -> Result<(), Error> {
+    for bag in Tlv::parse_all_ber(safe_contents)?.children()? {
+        let f = bag.children()?;
+        let Some(id) = f.first().and_then(|o| o.oid().ok()) else { continue };
+        let Some(value) = f.get(1).filter(|v| v.tag == tag::ctx(0)).and_then(|v| v.inner().ok()) else { continue };
+        let (mut local_key_id, mut friendly_name) = (None, None);
+        if let Some(attrs) = f.get(2) {
+            for a in attrs.children()? {
+                let p = a.children()?;
+                let v = p.get(1).and_then(|s| s.children().ok()).and_then(|s| s.into_iter().next());
+                match (p.first().and_then(|o| o.oid().ok()).as_deref(), v) {
+                    (Some(LOCAL_KEY_ID), Some(v)) => local_key_id = v.octets("local key id").ok().map(Cow::into_owned),
+                    (Some(FRIENDLY_NAME), Some(v)) => friendly_name = v.text(),
+                    _ => {}
+                }
+            }
+        }
+        let kind = match id.as_str() {
+            KEY_BAG => BagKind::Key(Zeroizing::new(value.raw.to_vec())),
+            SHROUDED_KEY_BAG => {
+                let p = value.children()?;
+                let [alg, data] = p.as_slice() else { return Err(bad("EncryptedPrivateKeyInfo")) };
+                BagKind::Key(pbe_decrypt(alg, password, &data.octets("encrypted private key")?, budget)?)
+            }
+            CERT_BAG => {
+                let p = value.children()?;
+                if p.first().and_then(|o| o.oid().ok()).as_deref() != Some(X509_CERT) {
+                    continue;
+                }
+                let Some(c) = p.get(1).and_then(|c| c.inner().ok()).and_then(|c| c.octets("certificate").ok()) else { continue };
+                BagKind::Cert(c.into_owned())
+            }
+            _ => continue,
+        };
+        out.push(Bag { kind, local_key_id, friendly_name });
+    }
+    Ok(())
+}
+
+fn normalize(bytes: &[u8]) -> Result<Cow<'_, [u8]>, Error> {
+    let start = bytes.iter().position(|b| !b.is_ascii_whitespace()).unwrap_or(0);
+    let end = bytes.iter().rposition(|b| !b.is_ascii_whitespace()).map_or(0, |i| i + 1);
+    let trimmed = bytes.get(start..end).unwrap_or(b""); // hostile input: no slicing by hand
+
+    // 1. A DER file starts with a SEQUENCE tag: borrow, no work.
+    if trimmed.first() == Some(&0x30) {
+        return Ok(Cow::Borrowed(trimmed));
+    }
+    // 2. PEM armor: base64 body between the BEGIN/END lines.
+    if trimmed.starts_with(b"-----BEGIN") {
+        let body = pem_body(trimmed)?;
+        return Ok(Cow::Owned(decode_base64(body)?));
+    }
+    // 3. Raw base64 text, armour or not (a real DER PFX always contains bytes
+    //    outside the base64 alphabet, so this can't swallow a valid file).
+    if trimmed.iter().all(|b| b.is_ascii_alphanumeric() || *b == b'+' || *b == b'/' || *b == b'=' || b.is_ascii_whitespace()) {
+        return Ok(Cow::Owned(decode_base64(trimmed)?));
+    }
+    // 4. Not recognisable: hand the bytes to Tlv::parse_all for a clear error.
+    Ok(Cow::Borrowed(trimmed))
+}
+
+fn decode_base64(input: &[u8]) -> Result<Vec<u8>, Error> {
+    let compact: Vec<u8> = input.iter().copied().filter(|b| !b.is_ascii_whitespace()).collect();
+    base64::engine::general_purpose::STANDARD.decode(&compact).map_err(|e| Error::Malformed(format!("PKCS #12: base64: {e}")))
+}
+
+/// The base64 lines between "-----BEGIN …-----" and "-----END …-----".
+fn pem_body(pem: &[u8]) -> Result<&[u8], Error> {
+    let text = std::str::from_utf8(pem).map_err(|_| bad("PEM file is not valid text"))?;
+    let begin = text.find("-----BEGIN ").ok_or_else(|| bad("PEM file has no BEGIN marker"))?;
+    let body_start = text[begin..].find('\n').map_or(text.len(), |i| begin + i + 1);
+    let body_end = text.find("-----END ").filter(|end| *end >= body_start).ok_or_else(|| bad("PEM file has no END marker"))?;
+    let body = text.as_bytes().get(body_start..body_end).ok_or_else(|| bad("PEM body"))?;
+    if !body.iter().any(|b| !b.is_ascii_whitespace()) {
+        return Err(bad("PEM file has an empty body"));
+    }
+    Ok(body)
+}
+
+/// Open a `.p12` / `.pfx` file. A wrong password is [`Error::WrongPassword`].
+pub fn open(bytes: &[u8], password: &str) -> Result<DigitalId, Error> {
+    let der = normalize(bytes)?;
+    let pfx = Tlv::parse_all_ber(&der)
+        .map_err(|e| match e {
+            // Keep "not a PKCS #12 file" but carry the exact reason through.
+            Error::Malformed(why) => bad(&format!("not a PKCS #12 file: {why}")),
+            e => e,
+        })?
+        .children()?;
+    let auth_safe = pfx.get(1).ok_or_else(|| bad("authSafe"))?.children()?;
+    if auth_safe.first().map(|o| o.oid()).transpose()?.as_deref() != Some(DATA) {
+        return Err(Error::Unsupported("public-key protected PKCS #12 files".into()));
+    }
+    let content = auth_safe.get(1).ok_or_else(|| bad("authSafe content"))?.inner()?.octets("authSafe")?;
+    let mut budget = Budget(OPEN_BUDGET);
+    // The MAC proves the password before anything is decrypted. It covers the contents of that
+    // OCTET STRING — the segments joined, if the file is segmented, which is what wrote them.
+    if let Some(mac) = pfx.get(2) {
+        let m = mac.children()?;
+        let digest_info = m.first().ok_or_else(|| bad("MacData"))?.children()?;
+        let alg = digest_info.first().ok_or_else(|| bad("MAC algorithm"))?.children()?;
+        let alg_oid = alg.first().ok_or_else(|| bad("MAC algorithm"))?.oid()?;
+        let alg = DigestAlg::from_oid(&alg_oid)
+            .filter(|d| matches!(d, DigestAlg::Sha1 | DigestAlg::Sha224 | DigestAlg::Sha256 | DigestAlg::Sha384 | DigestAlg::Sha512))
+            .ok_or_else(|| Error::Unsupported(format!("MAC digest {alg_oid}")))?;
+        let expected = digest_info.get(1).ok_or_else(|| bad("MAC"))?.octets("MAC")?;
+        let salt = m.get(1).ok_or_else(|| bad("MAC salt"))?.octets("MAC salt")?;
+        let iterations = m.get(2).map(|i| i.u64()).transpose()?.unwrap_or(1);
+        let key_len = alg.digest(&[]).len();
+        let iterations = budget.spend(alg, iterations, key_len)?;
+        let key = pkcs12_kdf(alg, &bmp(password), &salt, 3, iterations, key_len);
+        if hmac(alg, &key, &content)? != *expected {
+            return Err(Error::WrongPassword);
+        }
+    }
+    let mut all = Vec::new();
+    for ci in Tlv::parse_all_ber(&content)?.children()? {
+        let p = ci.children()?;
+        let kind = p.first().ok_or_else(|| bad("ContentInfo"))?.oid()?;
+        let body = p.get(1).ok_or_else(|| bad("ContentInfo content"))?.inner()?;
+        match kind.as_str() {
+            DATA => bags(&body.octets("SafeContents")?, password, &mut all, &mut budget)?,
+            ENCRYPTED_DATA => {
+                let ed = body.children()?;
+                let eci = ed.get(1).ok_or_else(|| bad("EncryptedContentInfo"))?.children()?;
+                let alg = eci.get(1).ok_or_else(|| bad("content encryption algorithm"))?;
+                let ct: Cow<'_, [u8]> = match eci.get(2) {
+                    Some(t) if t.tag == tag::ctx_prim(0) => Cow::Borrowed(t.value),
+                    // Constructed form: the OCTET STRING segments, joined.
+                    Some(t) if t.tag == tag::ctx(0) => {
+                        let mut v = Vec::with_capacity(t.value.len());
+                        for s in t.children()? {
+                            v.extend_from_slice(&s.octets("encryptedContent")?);
+                        }
+                        Cow::Owned(v)
+                    }
+                    _ => return Err(bad("encryptedContent")),
+                };
+                let plain = pbe_decrypt(alg, password, &ct, &mut budget)?;
+                bags(&plain, password, &mut all, &mut budget)?;
+            }
+            _ => {}
+        }
+    }
+    let (key_bag, pkcs8) = all
+        .iter()
+        .find_map(|b| match &b.kind {
+            BagKind::Key(k) => Some((b, k)),
+            _ => None,
+        })
+        .ok_or_else(|| bad("no private key"))?;
+    let key = PrivateKey::from_pkcs8(pkcs8)?;
+    let certs: Vec<(Certificate, &Bag)> = all
+        .iter()
+        .filter_map(|b| match &b.kind {
+            BagKind::Cert(c) => Certificate::parse(c).ok().map(|c| (c, b)),
+            _ => None,
+        })
+        .collect();
+    // The signer's certificate: the same local key id, else the one with the key's public key.
+    let idx = certs
+        .iter()
+        .position(|(_, b)| key_bag.local_key_id.is_some() && b.local_key_id == key_bag.local_key_id)
+        .or_else(|| certs.iter().position(|(c, _)| &c.public_key == key.public_key()))
+        .ok_or_else(|| bad("no certificate for the private key"))?;
+    let friendly_name = key_bag.friendly_name.clone().or_else(|| certs[idx].1.friendly_name.clone());
+    let mut certs: Vec<Certificate> = certs.into_iter().map(|(c, _)| c).collect();
+    let certificate = certs.remove(idx);
+    if &certificate.public_key != key.public_key() {
+        return Err(bad("the certificate does not match the private key"));
+    }
+    Ok(DigitalId { key, certificate, chain: certs, friendly_name })
+}
+
+fn random(n: usize) -> Result<Vec<u8>, Error> {
+    let mut v = vec![0u8; n];
+    getrandom::fill(&mut v).map_err(|e| Error::Crypto(format!("no randomness: {e}")))?;
+    Ok(v)
+}
+
+/// Write a digital ID as a `.p12` protected by `password`.
+pub fn write(id: &DigitalId, password: &str) -> Result<Vec<u8>, Error> {
+    let encrypt = |plain: &[u8]| -> Result<Vec<u8>, Error> {
+        let (salt, iv) = (random(16)?, random(16)?);
+        let key = pbkdf2(DigestAlg::Sha256, password.as_bytes(), &salt, WRITE_ROUNDS, 32)?;
+        let ct =
+            cbc::Encryptor::<aes::Aes256>::new_from_slices(&key, &iv).map_err(|_| Error::Crypto("AES".into()))?.encrypt_padded_vec::<Pkcs7>(plain);
+        let kdf = der::seq(&[
+            &der::oid(PBKDF2),
+            &der::seq(&[&der::octets(&salt), &der::int(WRITE_ROUNDS as u64), &der::seq(&[&der::oid(HMAC_SHA256), &der::null()])]),
+        ]);
+        let alg = der::seq(&[&der::oid(PBES2), &der::seq(&[&kdf, &der::seq(&[&der::oid(AES256_CBC), &der::octets(&iv)])])]);
+        Ok(der::seq(&[&alg, &der::octets(&ct)]))
+    };
+    let local_id = DigestAlg::Sha1.digest(&[&id.certificate.raw]);
+    let mut attrs: Vec<Vec<u8>> = vec![der::seq(&[&der::oid(LOCAL_KEY_ID), &der::set_of(&[&der::octets(&local_id)])])];
+    if let Some(n) = &id.friendly_name {
+        let v: Vec<u8> = n.encode_utf16().flat_map(u16::to_be_bytes).collect();
+        attrs.push(der::seq(&[&der::oid(FRIENDLY_NAME), &der::set_of(&[&der::tlv(tag::BMP_STRING, &v)])]));
+    }
+    let attr_refs: Vec<&[u8]> = attrs.iter().map(Vec::as_slice).collect();
+    let attr_set = der::set_of(&attr_refs);
+    let cert_bag = |c: &Certificate, with_attrs: bool| {
+        let value = der::explicit(0, &der::seq(&[&der::oid(X509_CERT), &der::explicit(0, &der::octets(&c.raw))]));
+        if with_attrs { der::seq(&[&der::oid(CERT_BAG), &value, &attr_set]) } else { der::seq(&[&der::oid(CERT_BAG), &value]) }
+    };
+    let mut cert_bags = vec![cert_bag(&id.certificate, true)];
+    cert_bags.extend(id.chain.iter().map(|c| cert_bag(c, false)));
+    let certs_plain = der::seq(&cert_bags.iter().map(Vec::as_slice).collect::<Vec<_>>());
+    let enc_certs = encrypt(&certs_plain)?;
+    // EncryptedData: version 0, EncryptedContentInfo { data, algorithm, [0] IMPLICIT ct }.
+    let enc_parts = Tlv::parse_all(&enc_certs)?.children()?;
+    let eci = der::seq(&[&der::oid(DATA), enc_parts[0].raw, &der::tlv(tag::ctx_prim(0), enc_parts[1].value)]);
+    let encrypted_data = der::seq(&[&der::int(0), &eci]);
+    let ci_certs = der::seq(&[&der::oid(ENCRYPTED_DATA), &der::explicit(0, &encrypted_data)]);
+    let key_bag = der::seq(&[&der::oid(SHROUDED_KEY_BAG), &der::explicit(0, &encrypt(id.key.pkcs8())?), &attr_set]);
+    let ci_key = der::seq(&[&der::oid(DATA), &der::explicit(0, &der::octets(&der::seq(&[&key_bag])))]);
+    let auth_safe = der::seq(&[&ci_certs, &ci_key]);
+    let salt = random(16)?;
+    let mac_key = pkcs12_kdf(DigestAlg::Sha256, &bmp(password), &salt, 3, WRITE_ROUNDS, 32);
+    let mac = hmac(DigestAlg::Sha256, &mac_key, &auth_safe)?;
+    let mac_data = der::seq(&[&der::seq(&[&DigestAlg::Sha256.algorithm(), &der::octets(&mac)]), &der::octets(&salt), &der::int(WRITE_ROUNDS as u64)]);
+    Ok(der::seq(&[&der::int(3), &der::seq(&[&der::oid(DATA), &der::explicit(0, &der::octets(&auth_safe))]), &mac_data]))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn one_budget_covers_every_derivation_in_a_file() {
+        let mut budget = Budget(OPEN_BUDGET);
+        // What a file from `write` needs: the MAC and two PBKDF2 derivations.
+        for _ in 0..3 {
+            assert_eq!(budget.spend(DigestAlg::Sha256, WRITE_ROUNDS.into(), 32).ok(), Some(WRITE_ROUNDS));
+        }
+        // Six million rounds fit once, but not twice.
+        assert!(budget.spend(DigestAlg::Sha256, 6_000_000, 32).is_ok());
+        assert!(budget.spend(DigestAlg::Sha256, 6_000_000, 32).is_err());
+        // Each output block repeats the rounds: 24 bytes of SHA-1 are two blocks.
+        let mut budget = Budget(OPEN_BUDGET);
+        assert!(budget.spend(DigestAlg::Sha1, 6_000_000, 24).is_err());
+        // Zero rounds still hashes once.
+        assert_eq!(budget.spend(DigestAlg::Sha1, 0, 20).ok(), Some(0));
+        assert_eq!(budget.0, OPEN_BUDGET - 1);
+    }
+
+    #[test]
+    fn key_and_kdf_buffers_are_zeroizing() {
+        let key = PrivateKey::generate_p256().unwrap();
+        let _: &Zeroizing<Vec<u8>> = &key.pkcs8;
+        let pw: Zeroizing<Vec<u8>> = bmp("secret12");
+        assert_eq!(&*pw, &[0, b's', 0, b'e', 0, b'c', 0, b'r', 0, b'e', 0, b't', 0, b'1', 0, b'2', 0, 0]);
+        let kdf: Zeroizing<Vec<u8>> = pkcs12_kdf(DigestAlg::Sha256, &pw, &[1, 2, 3, 4], 1, 1, 32);
+        assert_eq!(kdf.len(), 32);
+        let derived: Zeroizing<Vec<u8>> = pbkdf2(DigestAlg::Sha256, b"secret12", &[1, 2, 3, 4], 1, 32).unwrap();
+        assert_eq!(derived.len(), 32);
+    }
+}
diff --git a/crates/pkcs7/src/revocation.rs b/crates/pkcs7/src/revocation.rs
new file mode 100644
index 000000000..0aa9be9c6
--- /dev/null
+++ b/crates/pkcs7/src/revocation.rs
@@ -0,0 +1,309 @@
+//! Revocation evidence (RFC 5280 CRLs, RFC 6960 OCSP): parsing, signature verification and
+//! status lookup for evidence embedded in a DSS or supplied by the caller. Never fetches:
+//! the transport and the choice of evidence stay with the caller.
+
+use crate::der::{Tlv, tag};
+use crate::keys::{self, DigestAlg, PublicKey};
+use crate::x509::Certificate;
+use crate::{Error, Time};
+
+/// A DER size cap: real CRLs and OCSP responses are far smaller.
+pub(crate) const MAX_EVIDENCE: usize = 2 * 1024 * 1024;
+
+const ID_PKIX_OCSP_BASIC: &str = "1.3.6.1.5.5.7.48.1.1";
+const EKU_OCSP_SIGNING: &str = "1.3.6.1.5.5.7.3.9";
+
+/// What a piece of revocation evidence says about a certificate at a point in time.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum RevocationStatus {
+    /// The evidence covers the certificate and does not revoke it.
+    Good,
+    /// The evidence covers the certificate and revokes it.
+    Revoked { at: Time },
+    /// The evidence does not cover the certificate, is outside its window, or could not be
+    /// verified.
+    Unknown,
+}
+
+fn bad(what: impl Into<String>) -> Error {
+    Error::Malformed(format!("revocation: {}", what.into()))
+}
+
+fn strip(b: &[u8]) -> &[u8] {
+    match b {
+        [0, rest @ ..] if !rest.is_empty() => rest,
+        v => v,
+    }
+}
+
+fn valid_in_window(this: Time, next: Option<Time>, at: Time) -> bool {
+    at >= this && next.is_none_or(|n| at <= n)
+}
+
+/// Verify `signature` over the raw `signed` bytes with `key`, where the signature's algorithm
+/// identifier names the digest.
+fn verify_signature(signed: &[u8], alg_raw: &[u8], signature: &[u8], key: &PublicKey) -> bool {
+    let Ok(alg) = Tlv::parse_all(alg_raw) else { return false };
+    let Ok((scheme, Some(digest))) = keys::signature_algorithm(&alg) else { return false };
+    let d = digest.digest(&[signed]);
+    key.verify(scheme, digest, &d, signature).unwrap_or(false)
+}
+
+// ── X.509 CertificateList (CRL) ─────────────────────────────────────────────────────────────
+
+/// A parsed CRL (RFC 5280 §5.1).
+pub struct CertificateList {
+    tbs: Vec<u8>,
+    sig_alg: Vec<u8>,
+    signature: Vec<u8>,
+    pub issuer_raw: Vec<u8>,
+    pub this_update: Time,
+    pub next_update: Option<Time>,
+    /// (serial, revocation date), top to bottom.
+    pub revoked: Vec<(Vec<u8>, Time)>,
+}
+
+impl CertificateList {
+    pub fn parse(bytes: &[u8]) -> Result<CertificateList, Error> {
+        if bytes.is_empty() || bytes.len() > MAX_EVIDENCE {
+            return Err(bad("CRL is empty or exceeds the 2 MiB limit"));
+        }
+        let parts = Tlv::parse_all(bytes)?.expect(tag::SEQUENCE, "CertificateList")?.children()?;
+        let [tbs, alg, sig] = parts.as_slice() else { return Err(bad("CertificateList")) };
+        let mut f = tbs.children()?.into_iter().peekable();
+        if f.peek().is_some_and(|t| t.tag == tag::INTEGER) {
+            f.next(); // version
+        }
+        let _alg = f.next().ok_or_else(|| bad("tbsCertList"))?;
+        let issuer = f.next().ok_or_else(|| bad("tbsCertList"))?.raw.to_vec();
+        let this_update = f.next().ok_or_else(|| bad("tbsCertList"))?.time()?;
+        let mut next_update = None;
+        if f.peek().is_some_and(|t| t.tag == tag::UTC_TIME || t.tag == tag::GENERALIZED_TIME) {
+            next_update = f.next().map(|t| t.time()).transpose()?;
+        }
+        let mut revoked = Vec::new();
+        if f.peek().is_some_and(|t| t.tag == tag::SEQUENCE) {
+            for entry in f.next().ok_or_else(|| bad("revokedCertificates"))?.children()? {
+                let e = entry.children()?;
+                let serial = e.first().ok_or_else(|| bad("revoked entry"))?.uint_bytes().to_vec();
+                let at = e.get(1).ok_or_else(|| bad("revoked entry"))?.time()?;
+                revoked.push((serial, at));
+            }
+        }
+        Ok(CertificateList {
+            tbs: tbs.raw.to_vec(),
+            sig_alg: alg.raw.to_vec(),
+            signature: sig.bits()?.to_vec(),
+            issuer_raw: issuer,
+            this_update,
+            next_update,
+            revoked,
+        })
+    }
+
+    /// Check `cert` against this CRL at `at`. The CRL must be issued by `cert`'s issuer, its
+    /// signature must verify with the issuer's key, and `at` must fall inside its window.
+    pub fn check(&self, cert: &Certificate, issuer: &Certificate, at: Time) -> RevocationStatus {
+        if self.issuer_raw != issuer.subject.raw || issuer.subject.raw != cert.issuer.raw {
+            return RevocationStatus::Unknown;
+        }
+        if !verify_signature(&self.tbs, &self.sig_alg, &self.signature, &issuer.public_key) {
+            return RevocationStatus::Unknown;
+        }
+        if !valid_in_window(self.this_update, self.next_update, at) {
+            return RevocationStatus::Unknown;
+        }
+        match self.revoked.iter().find(|(serial, _)| strip(serial) == strip(&cert.serial)) {
+            Some((_, t)) => RevocationStatus::Revoked { at: *t },
+            None => RevocationStatus::Good,
+        }
+    }
+}
+
+// ── OCSP BasicOCSPResponse ──────────────────────────────────────────────────────────────────
+
+/// One `CertID` (RFC 6960 §4.1.1): hashes of the issuer's name and key, and the serial.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CertId {
+    pub hash_alg: DigestAlg,
+    pub issuer_name_hash: Vec<u8>,
+    pub issuer_key_hash: Vec<u8>,
+    pub serial: Vec<u8>,
+}
+
+impl CertId {
+    /// The `CertID` naming `cert` as issued by `issuer`, using `hash_alg`.
+    pub fn build(cert: &Certificate, issuer: &Certificate, hash_alg: DigestAlg) -> CertId {
+        CertId {
+            hash_alg,
+            issuer_name_hash: hash_alg.digest(&[&cert.issuer.raw]),
+            issuer_key_hash: hash_alg.digest(&[&issuer.public_key.key_bits()]),
+            serial: cert.serial.clone(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+enum CertStatus {
+    Good,
+    Revoked(Time),
+    Unknown,
+}
+
+/// One SingleResponse: the status of one certificate at a time.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SingleResponse {
+    pub cert_id: CertId,
+    status: CertStatus,
+    pub this_update: Time,
+    pub next_update: Option<Time>,
+}
+
+enum ResponderId {
+    ByName(Vec<u8>),
+    ByKey(Vec<u8>),
+}
+
+/// A parsed OCSP response (RFC 6960 §4.2.1): the responder's identity, per-certificate
+/// responses, and the delegated responder's certificate when it is embedded.
+pub struct OcspResponse {
+    tbs: Vec<u8>,
+    sig_alg: Vec<u8>,
+    signature: Vec<u8>,
+    responder_id: ResponderId,
+    pub responses: Vec<SingleResponse>,
+    responder_cert: Option<Certificate>,
+}
+
+impl OcspResponse {
+    pub fn parse(bytes: &[u8]) -> Result<OcspResponse, Error> {
+        if bytes.is_empty() || bytes.len() > MAX_EVIDENCE {
+            return Err(bad("OCSP response is empty or exceeds the 2 MiB limit"));
+        }
+        let resp = Tlv::parse_all(bytes)?.expect(tag::SEQUENCE, "OCSPResponse")?.children()?;
+        let status = resp.first().ok_or_else(|| bad("missing responseStatus"))?.enumerated()?;
+        if status != 0 {
+            return Err(bad(format!("responder reported an error (status {status})")));
+        }
+        let response_bytes =
+            resp.get(1).ok_or_else(|| bad("successful response has no responseBytes"))?.expect(tag::ctx(0), "responseBytes")?.inner()?.children()?;
+        let [type_oid, wrapped] = response_bytes.as_slice() else { return Err(bad("responseBytes")) };
+        if type_oid.oid()? != ID_PKIX_OCSP_BASIC {
+            return Err(bad("unsupported response type"));
+        }
+        let basic = Tlv::parse_all(wrapped.value)?.expect(tag::SEQUENCE, "BasicOCSPResponse")?.children()?;
+        let mut it = basic.into_iter();
+        let tbs = it.next().ok_or_else(|| bad("BasicOCSPResponse"))?;
+        let alg = it.next().ok_or_else(|| bad("BasicOCSPResponse"))?;
+        let signature = it.next().ok_or_else(|| bad("BasicOCSPResponse"))?.expect(tag::BIT_STRING, "signature")?.bits()?.to_vec();
+        let mut responder_cert = None;
+        for t in it {
+            if t.tag == tag::ctx(0) {
+                for c in t.children()? {
+                    if c.tag == tag::SEQUENCE
+                        && let Ok(cert) = Certificate::parse(c.raw)
+                    {
+                        responder_cert.get_or_insert(cert);
+                    }
+                }
+            }
+        }
+        let fields = tbs.children()?;
+        let mut f = fields.into_iter().peekable();
+        if f.peek().is_some_and(|t| t.tag == tag::ctx(0)) {
+            f.next(); // version
+        }
+        let rid = f.next().ok_or_else(|| bad("ResponseData"))?;
+        let responder_id = match rid.tag {
+            t if t == tag::ctx(1) => ResponderId::ByName(rid.value.to_vec()),
+            t if t == tag::ctx(2) => ResponderId::ByKey(Tlv::parse_all(rid.value)?.expect(tag::OCTET_STRING, "byKey responderID")?.value.to_vec()),
+            _ => return Err(bad("responderID")),
+        };
+        let _produced_at = f.next().ok_or_else(|| bad("ResponseData"))?.time()?;
+        let mut responses = Vec::new();
+        for single in f.next().ok_or_else(|| bad("ResponseData"))?.children()? {
+            let s = single.children()?;
+            let cert_id_fields = s.first().ok_or_else(|| bad("SingleResponse"))?.children()?;
+            let [hash_alg, name_hash, key_hash, serial] = cert_id_fields.as_slice() else { return Err(bad("CertID")) };
+            let alg_oid = hash_alg.children()?.first().ok_or_else(|| bad("CertID"))?.oid()?;
+            let Some(hash_alg) = DigestAlg::from_oid(&alg_oid) else { return Err(bad("unsupported CertID hash")) };
+            let cert_id = CertId {
+                hash_alg,
+                issuer_name_hash: name_hash.value.to_vec(),
+                issuer_key_hash: key_hash.value.to_vec(),
+                serial: serial.uint_bytes().to_vec(),
+            };
+            let status = match s.get(1).map(|t| t.tag) {
+                // RFC 6960 §4.2.1: CertStatus is CHOICE with IMPLICIT tags — good [0] NULL,
+                // revoked [1] RevokedInfo (the value is the RevokedInfo's own contents),
+                // unknown [2] UnknownInfo.
+                Some(t) if t == tag::ctx_prim(0) => CertStatus::Good,
+                Some(t) if t == tag::ctx(1) => {
+                    let info = s.get(1).unwrap_or(&single);
+                    let (date, _) = Tlv::parse(info.value)?;
+                    CertStatus::Revoked(date.time()?)
+                }
+                Some(t) if t == tag::ctx_prim(2) => CertStatus::Unknown,
+                _ => return Err(bad("certStatus")),
+            };
+            let this_update = s.get(2).ok_or_else(|| bad("SingleResponse"))?.time()?;
+            let next_update = s.get(3).filter(|t| t.tag == tag::ctx(0)).map(|t| t.inner().and_then(|g| g.time())).transpose()?;
+            responses.push(SingleResponse { cert_id, status, this_update, next_update });
+        }
+        Ok(OcspResponse { tbs: tbs.raw.to_vec(), sig_alg: alg.raw.to_vec(), signature, responder_id, responses, responder_cert })
+    }
+
+    /// Check `cert` (issued by `issuer`) at `at`. The responder must be the issuer itself, or
+    /// a delegated responder with the OCSP-signing EKU whose certificate is issued by the
+    /// issuer; the response signature and CertID must match, and `at` must fall inside the
+    /// response window.
+    pub fn check(&self, cert: &Certificate, issuer: &Certificate, at: Time) -> RevocationStatus {
+        // Who signed the response? The issuer identified by responderID, or a delegated,
+        // embedded responder identified the same way. Which of the two it is comes from that
+        // choice, never from the embedded certificate's names, which anyone can copy.
+        let (responder, delegated): (Option<&Certificate>, bool) = match &self.responder_id {
+            ResponderId::ByName(name) => {
+                if *name == issuer.subject.raw {
+                    (Some(issuer), false)
+                } else {
+                    (self.responder_cert.as_ref().filter(|c| *name == c.subject.raw), true)
+                }
+            }
+            ResponderId::ByKey(hash) => {
+                if *hash == DigestAlg::Sha1.digest(&[&issuer.public_key.key_bits()]) {
+                    (Some(issuer), false)
+                } else {
+                    (self.responder_cert.as_ref().filter(|c| *hash == DigestAlg::Sha1.digest(&[&c.public_key.key_bits()])), true)
+                }
+            }
+        };
+        let Some(responder) = responder else { return RevocationStatus::Unknown };
+        // A delegated responder must carry the OCSP-signing EKU and be issued by the issuer.
+        if delegated {
+            if responder.issuer.raw != issuer.subject.raw || !responder.signed_by(&issuer.public_key) {
+                return RevocationStatus::Unknown;
+            }
+            if !responder.extended_key_usage.as_ref().is_some_and(|e| e.iter().any(|o| o == EKU_OCSP_SIGNING)) {
+                return RevocationStatus::Unknown;
+            }
+        }
+        if !verify_signature(&self.tbs, &self.sig_alg, &self.signature, &responder.public_key) {
+            return RevocationStatus::Unknown;
+        }
+        // Find the SingleResponse for this certificate: the CertID hashes must recompute.
+        let single = self.responses.iter().find(|r| {
+            let name_hash = r.cert_id.hash_alg.digest(&[&cert.issuer.raw]);
+            let key_hash = r.cert_id.hash_alg.digest(&[&issuer.public_key.key_bits()]);
+            name_hash == r.cert_id.issuer_name_hash && key_hash == r.cert_id.issuer_key_hash && strip(&r.cert_id.serial) == strip(&cert.serial)
+        });
+        let Some(single) = single else { return RevocationStatus::Unknown };
+        if !valid_in_window(single.this_update, single.next_update, at) {
+            return RevocationStatus::Unknown;
+        }
+        match single.status {
+            CertStatus::Good => RevocationStatus::Good,
+            CertStatus::Revoked(at) => RevocationStatus::Revoked { at },
+            CertStatus::Unknown => RevocationStatus::Unknown,
+        }
+    }
+}
diff --git a/crates/pkcs7/src/rsa_pad.rs b/crates/pkcs7/src/rsa_pad.rs
new file mode 100644
index 000000000..fdd99a3d1
--- /dev/null
+++ b/crates/pkcs7/src/rsa_pad.rs
@@ -0,0 +1,147 @@
+//! RSA signature checks with the padding done here: the raw public-key operation comes from the
+//! `rsa` crate, and the EMSA-PKCS1-v1_5 / EMSA-PSS encodings (RFC 8017 §9) are checked against
+//! any digest, any MGF1 hash and any salt length, which the `rsa` crate's typed API can't do.
+//! Verification only; public data, so nothing here needs to be constant-time.
+
+use rsa::{BoxedUint, RsaPublicKey};
+
+use crate::Error;
+use crate::der;
+use crate::keys::{DigestAlg, PssParams};
+
+/// The encoded message `sig^e mod n` as exactly `n.len()` bytes, or `None` if the signature is
+/// out of range. `n` is the modulus without leading zeros. `notes` gets an entry when the
+/// signature value was not written with exactly the modulus' length (RFC 8017 §8.2.2 wants
+/// that); some signers drop or add leading zero bytes.
+fn encoded_message(n: &[u8], e: &[u8], sig: &[u8], notes: &mut Vec<&'static str>) -> Result<Option<Vec<u8>>, Error> {
+    // Redundant leading zeros would size the big-integer arithmetic (and the backend's own size
+    // limit) by the encoding rather than the number, so they are dropped before anything is built.
+    let (n, e) = (trim_zeros(n), trim_zeros(e));
+    let k = n.len();
+    let key = RsaPublicKey::new(BoxedUint::from_be_slice_vartime(n), BoxedUint::from_be_slice_vartime(e))
+        .map_err(|e| Error::Malformed(format!("RSA key: {e}")))?;
+    if sig.len() != k {
+        notes
+            .push("The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.");
+    }
+    let sig = match sig.iter().position(|b| *b != 0) {
+        Some(i) => sig.get(i..).unwrap_or_default(),
+        None => return Ok(None),
+    };
+    // RFC 8017 §5.2.2: the signature representative must be below the modulus. Otherwise s and
+    // s + n are the same number modulo n and both would verify. Both are big-endian without
+    // leading zeros here, so a longer one is larger and equal lengths compare byte by byte.
+    let modulus = n.get(n.iter().position(|b| *b != 0).unwrap_or(n.len())..).unwrap_or_default();
+    if sig.len() > modulus.len() || (sig.len() == modulus.len() && sig >= modulus) {
+        return Ok(None);
+    }
+    let Ok(em) = rsa::hazmat::rsa_encrypt(&key, &BoxedUint::from_be_slice_vartime(sig)) else { return Ok(None) };
+    let bytes = em.to_be_bytes();
+    let mut out = vec![0u8; k.saturating_sub(bytes.len())];
+    let skip = bytes.len().saturating_sub(k);
+    out.extend_from_slice(bytes.get(skip..).unwrap_or_default());
+    Ok(Some(out))
+}
+
+fn trim_zeros(b: &[u8]) -> &[u8] {
+    b.get(b.iter().position(|x| *x != 0).unwrap_or(b.len())..).unwrap_or_default()
+}
+
+/// `DigestInfo ::= SEQUENCE { AlgorithmIdentifier, OCTET STRING }`.
+fn digest_info(alg: DigestAlg, digest: &[u8], null_params: bool) -> Vec<u8> {
+    let id = der::algorithm(alg.oid(), null_params.then(der::null).as_deref());
+    der::seq(&[&id, &der::octets(digest)])
+}
+
+/// RSASSA-PKCS1-v1_5 (RFC 8017 §8.2.2): the signature is checked against the one encoding the
+/// message digest should have, built here and compared byte for byte, so there is nothing for a
+/// forger to put in trailing or padding bytes. Two `DigestInfo` encodings are accepted: with the
+/// NULL parameter (the standard one) and without it, which older signers write (RFC 8017 App. B.1
+/// has verifiers accept both); the second is noted in `notes`. A signature over the bare digest,
+/// without any `DigestInfo`, is not accepted: it does not say which hash algorithm it uses.
+pub fn pkcs1_verify(n: &[u8], e: &[u8], alg: DigestAlg, digest: &[u8], sig: &[u8], notes: &mut Vec<&'static str>) -> Result<bool, Error> {
+    let Some(em) = encoded_message(n, e, sig, notes)? else { return Ok(false) };
+    let k = em.len();
+    let forms = [
+        (digest_info(alg, digest, true), None),
+        (
+            digest_info(alg, digest, false),
+            Some("The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway."),
+        ),
+    ];
+    for (t, note) in forms {
+        let Some(ps) = k.checked_sub(t.len() + 3).filter(|ps| *ps >= 8) else { continue };
+        let mut expected = vec![0x00, 0x01];
+        expected.extend(std::iter::repeat_n(0xFF, ps));
+        expected.push(0x00);
+        expected.extend_from_slice(&t);
+        if expected == em {
+            notes.extend(note);
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
+/// MGF1 (RFC 8017 §B.2.1).
+fn mgf1(hash: DigestAlg, seed: &[u8], len: usize) -> Vec<u8> {
+    let mut out = Vec::with_capacity(len + hash.output_len());
+    let mut counter = 0u32;
+    while out.len() < len {
+        out.extend(hash.digest(&[seed, &counter.to_be_bytes()]));
+        counter = counter.wrapping_add(1);
+    }
+    out.truncate(len);
+    out
+}
+
+/// EMSA-PSS-VERIFY (RFC 8017 §9.1.2) with `digest` (of the message, with `alg`) as `mHash`.
+pub fn pss_verify(
+    n: &[u8],
+    e: &[u8],
+    alg: DigestAlg,
+    params: PssParams,
+    digest: &[u8],
+    sig: &[u8],
+    notes: &mut Vec<&'static str>,
+) -> Result<bool, Error> {
+    let Some(raw) = encoded_message(n, e, sig, notes)? else { return Ok(false) };
+    let n = trim_zeros(n);
+    let mod_bits = n.first().map_or(0, |b| (n.len() * 8) as u32 - b.leading_zeros());
+    let Some(em_bits) = mod_bits.checked_sub(1) else { return Ok(false) };
+    let em_len = em_bits.div_ceil(8) as usize;
+    // emLen is k, or k - 1 when the modulus is 8m+1 bits (then the top byte must be zero).
+    let Some(lead) = raw.len().checked_sub(em_len) else { return Ok(false) };
+    if raw.get(..lead).is_none_or(|l| l.iter().any(|b| *b != 0)) {
+        return Ok(false);
+    }
+    let em = raw.get(lead..).unwrap_or_default();
+    let h_len = alg.output_len();
+    if digest.len() != h_len {
+        return Ok(false);
+    }
+    let Some(db_len) = em_len.checked_sub(h_len + 1).filter(|l| *l >= 1) else { return Ok(false) };
+    if em.last() != Some(&0xBC) {
+        return Ok(false);
+    }
+    let Some((masked_db, rest)) = em.split_at_checked(db_len) else { return Ok(false) };
+    let Some(h) = rest.get(..h_len) else { return Ok(false) };
+    let spare = (8 * em_len as u32).saturating_sub(em_bits);
+    let top_mask = 0xFFu8.checked_shr(spare).unwrap_or(0);
+    if masked_db.first().is_none_or(|b| b & !top_mask != 0) {
+        return Ok(false);
+    }
+    let mut db: Vec<u8> = masked_db.iter().zip(mgf1(params.mgf, h, db_len)).map(|(a, b)| a ^ b).collect();
+    if let Some(b) = db.first_mut() {
+        *b &= top_mask;
+    }
+    let Some(sep) = db.iter().position(|b| *b != 0) else { return Ok(false) };
+    if db.get(sep) != Some(&1) {
+        return Ok(false);
+    }
+    let salt = db.get(sep + 1..).unwrap_or_default();
+    if params.salt_len.is_some_and(|l| l != salt.len()) {
+        return Ok(false);
+    }
+    Ok(alg.digest(&[&[0u8; 8], digest, salt]) == h)
+}
diff --git a/crates/pkcs7/src/timestamp.rs b/crates/pkcs7/src/timestamp.rs
new file mode 100644
index 000000000..d5c7b8cca
--- /dev/null
+++ b/crates/pkcs7/src/timestamp.rs
@@ -0,0 +1,253 @@
+//! RFC 3161 timestamp queries and tokens.
+//!
+//! Transport-free by design: callers encode a request, send it through an explicitly
+//! configured authority at the application boundary, and validate the returned DER response
+//! before the token is attached to a CMS signature. [`respond`] is the TSA-side signer, used
+//! by the deterministic test authority and by a locally configured stamping identity.
+
+use crate::cms::SignedData;
+use crate::der::{self, Tlv, tag};
+use crate::keys::{DigestAlg, PrivateKey};
+use crate::x509::Certificate;
+use crate::{Error, Time};
+
+const TST_INFO: &str = "1.2.840.113549.1.9.16.1.4";
+const MAX_RESPONSE: usize = 4 * 1024 * 1024;
+const MAX_TOKEN: usize = 2 * 1024 * 1024;
+const MAX_REQUEST: usize = 1024 * 1024;
+
+/// RFC 3161 request data. `nonce` is optional but recommended for online requests.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct TimestampQuery {
+    pub digest: DigestAlg,
+    pub imprint: Vec<u8>,
+    pub policy: Option<String>,
+    pub nonce: Option<u64>,
+    pub certificate_request: bool,
+}
+
+/// Identity and digest algorithm used by a timestamp authority to sign tokens.
+pub struct TimestampSigner<'a> {
+    pub key: &'a PrivateKey,
+    pub certificate: &'a Certificate,
+    pub chain: &'a [Certificate],
+    pub digest: DigestAlg,
+}
+
+/// Issuance details for one timestamp response.
+pub struct TimestampIssuance<'a> {
+    pub query: &'a TimestampQuery,
+    pub policy: &'a str,
+    pub generation_time: Time,
+    pub serial: u64,
+}
+
+impl TimestampQuery {
+    pub fn new(digest: DigestAlg, imprint: Vec<u8>) -> Result<Self, Error> {
+        if imprint.len() != digest.digest(&[&[]]).len() {
+            return Err(Error::Malformed("RFC 3161 imprint length does not match its digest algorithm".into()));
+        }
+        Ok(Self { digest, imprint, policy: None, nonce: None, certificate_request: true })
+    }
+
+    /// Encode a DER `TimeStampReq` (RFC 3161 §2.4.1).
+    pub fn encode(&self) -> Result<Vec<u8>, Error> {
+        let alg = self.digest.algorithm();
+        let imprint = der::seq(&[&alg, &der::octets(&self.imprint)]);
+        let mut parts: Vec<Vec<u8>> = vec![der::int(1), imprint];
+        if let Some(policy) = &self.policy {
+            parts.push(der::try_oid(policy)?);
+        }
+        if let Some(nonce) = self.nonce {
+            parts.push(der::int(nonce));
+        }
+        if self.certificate_request {
+            parts.push(der::boolean(true));
+        }
+        let refs: Vec<&[u8]> = parts.iter().map(Vec::as_slice).collect();
+        Ok(der::seq(&refs))
+    }
+}
+
+/// A validated RFC 3161 time-stamp token.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct TimestampToken {
+    pub raw: Vec<u8>,
+    pub digest: DigestAlg,
+    pub imprint: Vec<u8>,
+    pub policy: String,
+    pub serial: Vec<u8>,
+    pub gen_time: Time,
+    /// The TSTInfo nonce, when it has one that fits a `u64` (the size requests use).
+    pub nonce: Option<u64>,
+}
+
+impl TimestampToken {
+    /// The TSA's certificate, from the token's embedded certificates.
+    pub fn signer_certificate(&self) -> Option<Certificate> {
+        let token = SignedData::parse(&self.raw).ok()?;
+        token.signer_certificate().cloned()
+    }
+}
+
+/// A caller-supplied transport. The sign crate never creates sockets.
+pub trait TimestampAuthority {
+    fn timestamp(&self, request: &[u8]) -> Result<Vec<u8>, Error>;
+}
+
+/// The certificates carried inside a token's CMS (for trust anchoring at validation time).
+pub fn token_certs(raw: &[u8]) -> Vec<Certificate> {
+    SignedData::parse(raw).map(|sd| sd.certificates).unwrap_or_default()
+}
+
+fn bad(message: impl Into<String>) -> Error {
+    Error::Malformed(format!("RFC 3161: {}", message.into()))
+}
+
+/// Decode a `TimeStampReq` as [`TimestampQuery::encode`] wrote it.
+pub fn parse_request(bytes: &[u8]) -> Result<TimestampQuery, Error> {
+    if bytes.is_empty() || bytes.len() > MAX_REQUEST {
+        return Err(bad("request is empty or exceeds the 1 MiB limit"));
+    }
+    let fields = Tlv::parse_all(bytes)?.expect(tag::SEQUENCE, "TimeStampReq")?.children()?;
+    let mut it = fields.into_iter();
+    let _version = it.next().ok_or_else(|| bad("missing version"))?.u64()?;
+    let imprint = it.next().ok_or_else(|| bad("missing message imprint"))?.children()?;
+    let alg_oid =
+        imprint.first().ok_or_else(|| bad("missing imprint algorithm"))?.children()?.first().ok_or_else(|| bad("missing algorithm OID"))?.oid()?;
+    let digest = DigestAlg::from_oid(&alg_oid).ok_or_else(|| bad("unsupported imprint digest algorithm"))?;
+    let hash = imprint.get(1).ok_or_else(|| bad("missing imprint digest"))?.expect(tag::OCTET_STRING, "imprint digest")?.value.to_vec();
+    let mut q = TimestampQuery::new(digest, hash)?;
+    for f in it {
+        match f.tag {
+            tag::OID => q.policy = Some(f.oid()?),
+            tag::INTEGER => q.nonce = Some(f.u64()?),
+            tag::BOOLEAN => q.certificate_request = f.value.first() == Some(&0xFF),
+            _ => {}
+        }
+    }
+    Ok(q)
+}
+
+/// Parse and validate a token (a bare CMS `ContentInfo`): TSTInfo content, bounded size, the
+/// TSA's CMS signature and its message digest — but not the imprint, which callers compare
+/// against the signed data they hold.
+pub fn parse_token(raw: &[u8]) -> Result<TimestampToken, Error> {
+    if raw.is_empty() || raw.len() > MAX_TOKEN {
+        return Err(bad("token is empty or exceeds the 2 MiB limit"));
+    }
+    let token = SignedData::parse(raw)?;
+    if token.signer.content_type.as_deref() != Some(TST_INFO) {
+        return Err(bad("token content is not TSTInfo"));
+    }
+    let info = token.content.as_deref().ok_or_else(|| bad("token has no TSTInfo content"))?;
+    let fields = Tlv::parse_all(info)?.expect(tag::SEQUENCE, "TSTInfo")?.children()?;
+    let policy = fields.get(1).ok_or_else(|| bad("TSTInfo has no policy"))?.oid()?;
+    let imprint_fields = fields.get(2).ok_or_else(|| bad("TSTInfo has no message imprint"))?.children()?;
+    let alg_fields = imprint_fields.first().ok_or_else(|| bad("message imprint has no algorithm"))?.children()?;
+    let digest = alg_fields
+        .first()
+        .ok_or_else(|| bad("message imprint has no digest algorithm"))?
+        .oid()
+        .and_then(|o| DigestAlg::from_oid(&o).ok_or_else(|| bad("unsupported imprint digest algorithm")))?;
+    let imprint = imprint_fields
+        .get(1)
+        .ok_or_else(|| bad("message imprint has no digest"))?
+        .expect(tag::OCTET_STRING, "message imprint digest")?
+        .value
+        .to_vec();
+    let serial = fields.get(3).ok_or_else(|| bad("TSTInfo has no serial number"))?.uint_bytes().to_vec();
+    let gen_time = fields.get(4).ok_or_else(|| bad("TSTInfo has no generation time"))?.time()?;
+    // The nonce is the only INTEGER after genTime (RFC 3161 §2.4.2): accuracy is a SEQUENCE and
+    // ordering a BOOLEAN.
+    let nonce = fields.iter().skip(5).find(|f| f.tag == tag::INTEGER).and_then(|f| f.u64().ok());
+    // The signed messageDigest uses the SignerInfo's digest algorithm, which need not be the
+    // imprint's (RFC 5652 §5.4).
+    let content_digest = token.signer.digest.digest(&[info]);
+    if token.signer.message_digest.as_deref() != Some(content_digest.as_slice()) {
+        return Err(bad("token signed message digest does not match TSTInfo"));
+    }
+    let cert = token.signer_certificate().ok_or_else(|| bad("TSA certificate is missing"))?;
+    // An algorithm that can't be checked stays `Unsupported` rather than reading as invalid.
+    if !token.verify_signature(cert, &content_digest)? {
+        return Err(bad("TSA signature is invalid"));
+    }
+    Ok(TimestampToken { raw: raw.to_vec(), digest, imprint, policy, serial, gen_time, nonce })
+}
+
+/// Parse and validate a `TimeStampResp`, including the CMS signature and message imprint.
+pub fn parse_response(bytes: &[u8], query: &TimestampQuery) -> Result<TimestampToken, Error> {
+    if bytes.is_empty() || bytes.len() > MAX_RESPONSE {
+        return Err(bad("response is empty or exceeds the 4 MiB limit"));
+    }
+    let fields = Tlv::parse_all(bytes)?.expect(tag::SEQUENCE, "TimeStampResp")?.children()?;
+    let status_info = fields.first().ok_or_else(|| bad("missing status"))?.children()?;
+    let status = status_info.first().ok_or_else(|| bad("missing status value"))?.u64()?;
+    if status != 0 && status != 1 {
+        return Err(bad(format!("TSA rejected the request (status {status})")));
+    }
+    let token = fields.get(1).ok_or_else(|| bad("granted response has no time-stamp token"))?;
+    let token = parse_token(token.raw)?;
+    if token.digest != query.digest || token.imprint != query.imprint {
+        return Err(bad("message imprint does not match the requested digest"));
+    }
+    if query.nonce.is_some() && token.nonce != query.nonce {
+        return Err(bad("time-stamp token does not carry the requested nonce"));
+    }
+    if query.policy.as_ref().is_some_and(|p| *p != token.policy) {
+        return Err(bad("time-stamp token was issued under another policy than the one requested"));
+    }
+    Ok(token)
+}
+
+/// The TSA side: sign a `TimeStampResp` for `query` at `gen_time`. Used by deterministic test
+/// authorities and a locally configured stamping identity, never implied to be a remote TSA.
+pub fn respond(signer: TimestampSigner<'_>, issuance: TimestampIssuance<'_>) -> Result<Vec<u8>, Error> {
+    let TimestampSigner { key, certificate: cert, chain, digest: alg } = signer;
+    let TimestampIssuance { query, policy, generation_time: gen_time, serial } = issuance;
+    let mut info = vec![
+        der::int(1),
+        der::try_oid(policy)?,
+        der::seq(&[&query.digest.algorithm(), &der::octets(&query.imprint)]),
+        der::int(serial),
+        gen_time.encode(),
+    ];
+    if let Some(nonce) = query.nonce {
+        info.push(der::int(nonce));
+    }
+    let refs: Vec<&[u8]> = info.iter().map(Vec::as_slice).collect();
+    let tst_info = der::seq(&refs);
+    let token = crate::cms::sign_encapsulated(key, cert, chain, alg, TST_INFO, &tst_info)?;
+    let status = der::seq(&[&der::int(0)]);
+    Ok(der::seq(&[&status, &token]))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn request_round_trips_with_options() {
+        let imprint = DigestAlg::Sha256.digest(&[b"document"]);
+        let mut q = TimestampQuery::new(DigestAlg::Sha256, imprint.clone()).unwrap();
+        q.policy = Some("1.2.3.4".into());
+        q.nonce = Some(42);
+        let encoded = q.encode().unwrap();
+        let parsed = parse_request(&encoded).unwrap();
+        assert_eq!(parsed, q);
+        // The encoded fields themselves.
+        let fields = Tlv::parse_all(&encoded).unwrap().children().unwrap();
+        assert_eq!(fields[0].u64().unwrap(), 1);
+        assert_eq!(fields[1].children().unwrap()[1].value, imprint.as_slice());
+        assert_eq!(fields[2].oid().unwrap(), "1.2.3.4");
+        assert_eq!(fields[3].u64().unwrap(), 42);
+        assert_eq!(fields[4].value, &[0xff]);
+    }
+
+    #[test]
+    fn rejects_oversized_response_before_parsing() {
+        let q = TimestampQuery::new(DigestAlg::Sha256, vec![0; 32]).unwrap();
+        assert!(parse_response(&vec![0; MAX_RESPONSE + 1], &q).is_err());
+        assert!(parse_request(&vec![0; MAX_REQUEST + 1]).is_err());
+    }
+}
diff --git a/crates/pkcs7/src/x509.rs b/crates/pkcs7/src/x509.rs
new file mode 100644
index 000000000..0743588fd
--- /dev/null
+++ b/crates/pkcs7/src/x509.rs
@@ -0,0 +1,704 @@
+//! X.509 certificates (RFC 5280): the fields signing and validation need, signature checks
+//! along a chain, and a self-signed certificate builder for new digital IDs.
+
+use crate::Error;
+use crate::der::{self, Time, Tlv, tag};
+use crate::keys::{self, DigestAlg, PrivateKey, PublicKey};
+
+const CN: &str = "2.5.4.3";
+const C: &str = "2.5.4.6";
+const O: &str = "2.5.4.10";
+const OU: &str = "2.5.4.11";
+const EMAIL: &str = "1.2.840.113549.1.9.1";
+
+/// A distinguished name: (attribute OID, value) in order.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Name {
+    pub attrs: Vec<(String, String)>,
+    /// The DER encoding, compared byte for byte when matching issuers to subjects.
+    pub raw: Vec<u8>,
+}
+
+impl Name {
+    fn parse(t: &Tlv<'_>) -> Result<Name, Error> {
+        let mut attrs = Vec::new();
+        for rdn in t.expect(tag::SEQUENCE, "Name")?.children()? {
+            for atv in rdn.children()? {
+                let parts = atv.children()?;
+                if let [o, v] = parts.as_slice() {
+                    attrs.push((o.oid()?, v.text().unwrap_or_default()));
+                }
+            }
+        }
+        Ok(Name { attrs, raw: t.raw.to_vec() })
+    }
+
+    fn get(&self, oid: &str) -> Option<&str> {
+        self.attrs.iter().find(|(o, _)| o == oid).map(|(_, v)| v.as_str())
+    }
+
+    pub fn common_name(&self) -> Option<&str> {
+        self.get(CN)
+    }
+
+    pub fn organization(&self) -> Option<&str> {
+        self.get(O)
+    }
+
+    pub fn unit(&self) -> Option<&str> {
+        self.get(OU)
+    }
+
+    pub fn email(&self) -> Option<&str> {
+        self.get(EMAIL)
+    }
+
+    pub fn country(&self) -> Option<&str> {
+        self.get(C)
+    }
+
+    /// The name Acrobat shows: the common name, else the organization, else the DN.
+    pub fn display_name(&self) -> String {
+        self.common_name().or(self.organization()).map(str::to_string).unwrap_or_else(|| self.display())
+    }
+
+    /// "CN=Ada Lovelace, O=Example, E=ada@example.com"
+    pub fn display(&self) -> String {
+        self.attrs
+            .iter()
+            .map(|(o, v)| {
+                let k = match o.as_str() {
+                    CN => "CN",
+                    C => "C",
+                    O => "O",
+                    OU => "OU",
+                    EMAIL => "E",
+                    "2.5.4.7" => "L",
+                    "2.5.4.8" => "ST",
+                    other => other,
+                };
+                format!("{k}={v}")
+            })
+            .collect::<Vec<_>>()
+            .join(", ")
+    }
+
+    /// A name from its parts (empty ones left out), in the usual order.
+    pub fn build(cn: &str, ou: &str, o: &str, email: &str, country: &str) -> Name {
+        let mut rdns: Vec<Vec<u8>> = Vec::new();
+        let mut attrs = Vec::new();
+        let mut add = |oid: &str, enc: Vec<u8>, v: &str| {
+            if !v.trim().is_empty() {
+                rdns.push(der::set_of(&[&der::seq(&[&der::oid(oid), &enc])]));
+                attrs.push((oid.to_string(), v.trim().to_string()));
+            }
+        };
+        let country = country.trim().to_ascii_uppercase();
+        if country.len() == 2 {
+            add(C, der::printable(&country), &country);
+        }
+        add(O, der::utf8(o.trim()), o);
+        add(OU, der::utf8(ou.trim()), ou);
+        add(CN, der::utf8(cn.trim()), cn);
+        add(EMAIL, der::ia5(email.trim()), email);
+        let raw = der::tlv(tag::SEQUENCE, &rdns.concat());
+        Name { attrs, raw }
+    }
+}
+
+/// A parsed certificate.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Certificate {
+    /// The whole DER encoding.
+    pub raw: Vec<u8>,
+    tbs: Vec<u8>,
+    sig_alg: Vec<u8>,
+    signature: Vec<u8>,
+    pub serial: Vec<u8>,
+    pub issuer: Name,
+    pub subject: Name,
+    pub not_before: Time,
+    pub not_after: Time,
+    pub public_key: PublicKey,
+    /// Basic constraints: a CA certificate.
+    pub is_ca: bool,
+    /// Whether the certificate has a basicConstraints extension at all (old v1 roots don't).
+    pub has_basic_constraints: bool,
+    /// Basic constraints `pathLenConstraint`: how many CA certificates may follow this one
+    /// before the end-entity certificate.
+    pub path_len: Option<u32>,
+    /// Key usage bits (bit 0 = digitalSignature, 1 = nonRepudiation, 5 = keyCertSign), if present.
+    pub key_usage: Option<u16>,
+    pub subject_key_id: Option<Vec<u8>>,
+    /// Authority key identifier (2.5.29.35), when present.
+    pub authority_key_id: Option<Vec<u8>>,
+    /// Extended key usage OIDs (2.5.29.37), when present.
+    pub extended_key_usage: Option<Vec<String>>,
+    /// OCSP responder URLs from the Authority Information Access (1.3.6.1.5.5.7.1.1).
+    pub ocsp_urls: Vec<String>,
+    /// CRL distribution point URLs (2.5.29.31).
+    pub crl_urls: Vec<String>,
+    /// The `version` field: 0 for v1, 1 for v2, 2 for v3.
+    pub version: u64,
+    /// OIDs of extensions marked critical that this crate does not process (RFC 5280 §4.2).
+    pub unknown_critical: Vec<String>,
+}
+
+/// Extensions this crate reads or may safely ignore when they are critical: the ones
+/// `Extensions::read` handles, subject/issuer alternative names, and certificate policies
+/// (accepted as any policy).
+/// qcStatements (1.3.6.1.5.5.7.1.3) is included: RFC 3739 lets qualified (eIDAS and other national)
+/// certificates mark it critical, and it declares the certificate's status rather than limiting
+/// what the key may sign.
+const PROCESSED_EXTENSIONS: [&str; 11] = [
+    "2.5.29.19",
+    "2.5.29.15",
+    "2.5.29.14",
+    "2.5.29.35",
+    "2.5.29.37",
+    "1.3.6.1.5.5.7.1.1",
+    "2.5.29.31",
+    "2.5.29.17",
+    "2.5.29.18",
+    "2.5.29.32",
+    "1.3.6.1.5.5.7.1.3",
+];
+
+/// id-kp-timeStamping (RFC 5280 §4.2.1.12), required of a timestamp authority (RFC 3161 §2.3).
+const EKU_TIME_STAMPING: &str = "1.3.6.1.5.5.7.3.8";
+
+/// Extended key usages that allow signing documents: anyExtendedKeyUsage, emailProtection,
+/// codeSigning, documentSigning (RFC 9336), Adobe Authentic Documents and Microsoft document
+/// signing.
+const DOCUMENT_SIGNING_EKUS: [&str; 6] =
+    ["2.5.29.37.0", "1.3.6.1.5.5.7.3.4", "1.3.6.1.5.5.7.3.3", "1.3.6.1.5.5.7.3.36", "1.2.840.113583.1.1.5", "1.3.6.1.4.1.311.10.3.12"];
+
+/// The certificate extensions `Certificate::parse` reads, gathered tolerantly: an
+/// extension that does not parse leaves its field at the default instead of failing the
+/// certificate (real-world issuers use encodings with edge cases, e.g. a single-URI CRL
+/// distribution point whose `fullName [0]` is IMPLICIT over a bare GeneralName).
+#[derive(Default)]
+struct Extensions {
+    is_ca: bool,
+    has_basic_constraints: bool,
+    path_len: Option<u32>,
+    key_usage: Option<u16>,
+    subject_key_id: Option<Vec<u8>>,
+    authority_key_id: Option<Vec<u8>>,
+    extended_key_usage: Option<Vec<String>>,
+    ocsp_urls: Vec<String>,
+    crl_urls: Vec<String>,
+}
+
+impl Extensions {
+    fn read(&mut self, oid: &str, value: &Tlv<'_>) {
+        match oid {
+            "2.5.29.19" => {
+                // Present at all, even when it doesn't parse: a malformed basicConstraints must
+                // not make a certificate look like an old v1 root (which may issue). Unparsed,
+                // it stays "not a CA".
+                self.has_basic_constraints = true;
+                let Ok(bc) = Tlv::parse_all(value.value) else { return };
+                let fields = bc.children().unwrap_or_default();
+                self.is_ca = fields.first().is_some_and(|b| b.tag == tag::BOOLEAN && b.value != [0]);
+                // pathLenConstraint is the INTEGER after the optional cA BOOLEAN. One that is
+                // present but unreadable (negative, too long) allows no CA below, not any number.
+                self.path_len = fields.iter().find(|t| t.tag == tag::INTEGER).map(|t| t.u64().map_or(0, |n| u32::try_from(n).unwrap_or(u32::MAX)));
+            }
+            "2.5.29.15" => {
+                // A keyUsage that is present restricts the key even when it doesn't parse: an
+                // unreadable one allows no usage at all, never every usage.
+                self.key_usage = Some(0);
+                let Ok(bits) = Tlv::parse_all(value.value) else { return };
+                let Some((_, b)) = bits.value.split_first() else { return };
+                // Bit 0 is the most significant bit of the first byte.
+                let mut u = 0u16;
+                for (i, byte) in b.iter().take(2).enumerate() {
+                    for j in 0..8 {
+                        if byte & (0x80 >> j) != 0 {
+                            u |= 1 << (i * 8 + j);
+                        }
+                    }
+                }
+                self.key_usage = Some(u);
+            }
+            "2.5.29.14" => {
+                if let Ok(ski) = Tlv::parse_all(value.value) {
+                    self.subject_key_id = Some(ski.value.to_vec());
+                }
+            }
+            // AuthorityKeyIdentifier: the [0] keyIdentifier inside.
+            "2.5.29.35" => {
+                if let Ok(aki) = Tlv::parse_all(value.value) {
+                    self.authority_key_id = aki.children().ok().and_then(|c| c.into_iter().find(|t| t.tag == tag::ctx(0))).map(|t| t.value.to_vec());
+                }
+            }
+            // ExtendedKeyUsage: a SEQUENCE OF OID. Like keyUsage, one that is present restricts
+            // the key even when it doesn't parse: an unreadable one allows no purpose at all.
+            "2.5.29.37" => {
+                let purposes = Tlv::parse_all(value.value)
+                    .ok()
+                    .filter(|eku| eku.tag == tag::SEQUENCE)
+                    .and_then(|eku| eku.children().ok())
+                    .and_then(|c| c.iter().map(|t| t.oid().ok()).collect::<Option<Vec<_>>>());
+                self.extended_key_usage = Some(purposes.unwrap_or_default());
+            }
+            // Authority Information Access: OCSP and CA-issuer locations.
+            "1.3.6.1.5.5.7.1.1" => {
+                let Ok(aia) = Tlv::parse_all(value.value) else { return };
+                for access in aia.children().unwrap_or_default() {
+                    let Ok(a) = access.children() else { continue };
+                    if a.len() >= 2 && a[0].oid().ok().as_deref() == Some("1.3.6.1.5.5.7.48.1") && a[1].tag == tag::ctx_prim(6) {
+                        self.ocsp_urls.push(String::from_utf8_lossy(a[1].value).into_owned());
+                    }
+                }
+            }
+            // CRL distribution points: full-name URIs.
+            "2.5.29.31" => {
+                let Ok(dps) = Tlv::parse_all(value.value) else { return };
+                for dp in dps.children().unwrap_or_default() {
+                    let Ok(fields) = dp.children() else { continue };
+                    for field in fields {
+                        if field.tag != tag::ctx(0) {
+                            continue;
+                        }
+                        // distributionPoint [0] DistributionPointName, whose fullName choice is
+                        // [0] IMPLICIT GeneralNames: the value is a run of GeneralNames, not a
+                        // wrapped SEQUENCE (and often a single URI).
+                        let Ok(name) = field.inner() else { continue };
+                        if name.tag != tag::ctx(0) {
+                            continue;
+                        }
+                        let mut rest = name.value;
+                        while !rest.is_empty() {
+                            let Ok((n, r)) = Tlv::parse(rest) else { break };
+                            rest = r;
+                            if n.tag == tag::ctx_prim(6) {
+                                self.crl_urls.push(String::from_utf8_lossy(n.value).into_owned());
+                            }
+                        }
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+/// Why a certificate may not sign documents ([`Certificate::signing_problem`]).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum SigningProblem {
+    /// Its key usage has neither digitalSignature nor nonRepudiation.
+    KeyUsage,
+    /// Its extended key usage has no document-signing purpose.
+    ExtendedKeyUsage,
+    /// It has critical extensions this crate does not process: their OIDs.
+    UnknownCritical(Vec<String>),
+}
+
+/// Why a certificate that matched an issuer by name and signature was not used as the issuer
+/// ([`build_chain_noted`]).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum RefusedWhy {
+    /// It is not a CA certificate that may issue certificates.
+    NotCa,
+    /// It has critical extensions this crate does not process (and is not self-signed).
+    UnknownCritical,
+    /// Its path length constraint does not allow this many CA certificates below it.
+    PathLength,
+    /// It was not valid at the time asked about.
+    NotValid,
+}
+
+/// A candidate issuer [`build_chain_noted`] refused, and the certificate it would have vouched for.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Refused<'a> {
+    pub why: RefusedWhy,
+    pub issuer: &'a Certificate,
+    pub subject: &'a Certificate,
+}
+
+impl Certificate {
+    pub fn parse(raw: &[u8]) -> Result<Certificate, Error> {
+        let cert = Tlv::parse_all(raw)?.expect(tag::SEQUENCE, "Certificate")?;
+        let parts = cert.children()?;
+        let [tbs, sig_alg, sig] = parts.as_slice() else { return Err(Error::Malformed("Certificate".into())) };
+        let mut f = tbs.children()?.into_iter().peekable();
+        // version [0] EXPLICIT INTEGER DEFAULT v1 (0); v3 is 2. Unreadable counts as v3, the
+        // stricter reading (no v1-root exception in `may_issue`).
+        let mut version = 0u64;
+        if f.peek().is_some_and(|t| t.tag == tag::ctx(0)) {
+            version = f.next().and_then(|v| v.inner().ok()).and_then(|v| v.u64().ok()).unwrap_or(2);
+        }
+        let serial = f.next().ok_or_else(|| Error::Malformed("serial".into()))?.expect(tag::INTEGER, "serial")?.value.to_vec();
+        let _inner_alg = f.next();
+        let issuer = Name::parse(&f.next().ok_or_else(|| Error::Malformed("issuer".into()))?)?;
+        let validity = f.next().ok_or_else(|| Error::Malformed("validity".into()))?.children()?;
+        let [nb, na] = validity.as_slice() else { return Err(Error::Malformed("validity".into())) };
+        let subject = Name::parse(&f.next().ok_or_else(|| Error::Malformed("subject".into()))?)?;
+        let public_key = PublicKey::from_spki(&f.next().ok_or_else(|| Error::Malformed("public key".into()))?)?;
+        let mut ext = Extensions::default();
+        let mut unknown_critical = Vec::new();
+        for t in f {
+            if t.tag != tag::ctx(3) {
+                continue;
+            }
+            for ext_tlv in t.inner()?.children()? {
+                let e = ext_tlv.children()?;
+                let Some(o) = e.first().and_then(|o| o.oid().ok()) else { continue };
+                let Some(value) = e.last().filter(|v| v.tag == tag::OCTET_STRING) else { continue };
+                let critical = e.len() == 3 && e.get(1).is_some_and(|b| b.tag == tag::BOOLEAN && b.value != [0]);
+                if critical && !PROCESSED_EXTENSIONS.contains(&o.as_str()) {
+                    unknown_critical.push(o.clone());
+                }
+                // A malformed or unreadable extension must never reject the whole certificate:
+                // unreadable ones are skipped and the fields they carry keep their defaults.
+                ext.read(o.as_str(), value);
+            }
+        }
+        let Extensions {
+            is_ca,
+            has_basic_constraints,
+            path_len,
+            key_usage,
+            subject_key_id,
+            authority_key_id,
+            extended_key_usage,
+            ocsp_urls,
+            crl_urls,
+        } = ext;
+        Ok(Certificate {
+            raw: raw.to_vec(),
+            tbs: tbs.raw.to_vec(),
+            sig_alg: sig_alg.raw.to_vec(),
+            signature: sig.bits()?.to_vec(),
+            serial,
+            issuer,
+            subject,
+            not_before: nb.time()?,
+            not_after: na.time()?,
+            public_key,
+            is_ca,
+            has_basic_constraints,
+            path_len,
+            key_usage,
+            subject_key_id,
+            authority_key_id,
+            extended_key_usage,
+            ocsp_urls,
+            crl_urls,
+            version,
+            unknown_critical,
+        })
+    }
+
+    /// Why this certificate may not sign documents, if it may not (RFC 5280 §4.2.1.3,
+    /// §4.2.1.12, §4.2): a key usage without digitalSignature or nonRepudiation, an extended key
+    /// usage without a document-signing purpose, or a critical extension this crate doesn't process.
+    pub fn signing_problem(&self) -> Option<SigningProblem> {
+        /// keyUsage bits 0 (digitalSignature) and 1 (nonRepudiation).
+        const SIGNING_BITS: u16 = 0b11;
+        if self.key_usage.is_some_and(|u| u & SIGNING_BITS == 0) {
+            Some(SigningProblem::KeyUsage)
+        } else if self.extended_key_usage.as_ref().is_some_and(|e| !e.iter().any(|o| DOCUMENT_SIGNING_EKUS.contains(&o.as_str()))) {
+            Some(SigningProblem::ExtendedKeyUsage)
+        } else if !self.unknown_critical.is_empty() {
+            Some(SigningProblem::UnknownCritical(self.unknown_critical.clone()))
+        } else {
+            None
+        }
+    }
+
+    /// Whether this certificate may stamp trusted time (RFC 3161 §2.3): its extended key usage
+    /// includes timeStamping, its key usage (if any) allows digital signatures or
+    /// non-repudiation, and it has no critical extension this crate doesn't process. A certificate
+    /// issued for another purpose proves who signed, not when.
+    pub fn may_timestamp(&self) -> bool {
+        /// keyUsage bits 0 (digitalSignature) and 1 (nonRepudiation).
+        const SIGNING_BITS: u16 = 0b11;
+        self.extended_key_usage.as_ref().is_some_and(|e| e.iter().any(|o| o == EKU_TIME_STAMPING))
+            && self.key_usage.is_none_or(|u| u & SIGNING_BITS != 0)
+            && self.unknown_critical.is_empty()
+    }
+
+    /// Issued by itself (subject = issuer and its own key verifies it).
+    pub fn is_self_signed(&self) -> bool {
+        self.issuer.raw == self.subject.raw && self.signed_by(&self.public_key)
+    }
+
+    /// Whether `key` verifies this certificate's signature.
+    pub fn signed_by(&self, key: &PublicKey) -> bool {
+        self.signed_by_cached(key, &mut None)
+    }
+
+    /// [`Self::signed_by`] keeping the digest of the signed part in `digest`, so checking one
+    /// certificate against many candidate keys hashes it once.
+    fn signed_by_cached(&self, key: &PublicKey, digest: &mut Option<Vec<u8>>) -> bool {
+        let Ok(alg) = Tlv::parse_all(&self.sig_alg) else { return false };
+        match keys::signature_algorithm(&alg) {
+            Ok((scheme @ keys::Scheme::Ed25519, _)) => key.verify_message(scheme, &self.tbs, &self.signature).unwrap_or(false),
+            Ok((scheme, Some(d))) => {
+                let hash = digest.get_or_insert_with(|| d.digest(&[&self.tbs]));
+                key.verify(scheme, d, hash, &self.signature).unwrap_or(false)
+            }
+            _ => false,
+        }
+    }
+
+    /// Whether this certificate may issue certificates (RFC 5280 §4.2.1.9, §4.2.1.3): it is a
+    /// CA by its basic constraints, and if it has a key usage, that includes `keyCertSign`. A
+    /// self-signed v1 or v2 certificate (an old root, which predates extensions) with no basic
+    /// constraints counts as a CA; a v3 certificate must say it is one.
+    pub fn may_issue(&self) -> bool {
+        /// keyUsage bit 5.
+        const KEY_CERT_SIGN: u16 = 1 << 5;
+        let old_root = self.version < 2 && !self.has_basic_constraints && self.is_self_signed();
+        (self.is_ca || old_root) && self.key_usage.is_none_or(|u| u & KEY_CERT_SIGN != 0)
+    }
+
+    /// Valid at `t`.
+    pub fn valid_at(&self, t: Time) -> bool {
+        self.not_before <= t && t <= self.not_after
+    }
+
+    /// The display name Acrobat uses: the common name, else the organization, else the DN.
+    pub fn display_name(&self) -> String {
+        self.subject.display_name()
+    }
+
+    /// SHA-256 fingerprint as upper-case hex pairs.
+    pub fn fingerprint(&self) -> String {
+        DigestAlg::Sha256.digest(&[&self.raw]).iter().map(|b| format!("{b:02X}")).collect::<Vec<_>>().join(" ")
+    }
+
+    pub fn serial_hex(&self) -> String {
+        self.serial.iter().map(|b| format!("{b:02X}")).collect()
+    }
+
+    /// A self-signed certificate for `key`: what Acrobat's "Create a new digital ID ▸ save to
+    /// file" makes. Valid from `from` for `years`; usable for signing (digital signature and
+    /// non-repudiation).
+    pub fn self_signed(name: &Name, key: &PrivateKey, from: Time, years: u32, serial: &[u8]) -> Result<Certificate, Error> {
+        let alg = key.preferred_digest();
+        let sig_alg = key.signature_algorithm(alg);
+        let until = Time { year: from.year + years, ..from };
+        let spki = key.public_key().spki();
+        let ski = DigestAlg::Sha1.digest(&[&spki]);
+        let ext = |o: &str, critical: bool, value: &[u8]| {
+            if critical {
+                der::seq(&[&der::oid(o), &der::boolean(true), &der::octets(value)])
+            } else {
+                der::seq(&[&der::oid(o), &der::octets(value)])
+            }
+        };
+        // keyUsage: digitalSignature (bit 0) and nonRepudiation (bit 1) → 0b1100_0000, 6 unused bits.
+        let key_usage = der::tlv(tag::BIT_STRING, &[6, 0b1100_0000]);
+        let extensions = der::seq(&[
+            &ext("2.5.29.15", true, &key_usage),
+            &ext("2.5.29.14", false, &der::octets(&ski)),
+            // extKeyUsage: emailProtection and Adobe's document signing (1.2.840.113583.1.1.5).
+            &ext("2.5.29.37", false, &der::seq(&[&der::oid("1.3.6.1.5.5.7.3.4"), &der::oid("1.2.840.113583.1.1.5")])),
+        ]);
+        let tbs = der::seq(&[
+            &der::explicit(0, &der::int(2)),
+            &der::uint(serial),
+            &sig_alg,
+            &name.raw,
+            &der::seq(&[&from.encode(), &until.encode()]),
+            &name.raw,
+            &spki,
+            &der::explicit(3, &extensions),
+        ]);
+        let signature = key.sign(alg, &tbs)?;
+        let cert = der::seq(&[&tbs, &sig_alg, &der::bit_string(&signature)]);
+        Certificate::parse(&cert)
+    }
+}
+
+/// The subject alone, to name a certificate `Certificate::parse` rejects (one with a key type
+/// this crate doesn't support, say). `None` when even that can't be read.
+pub fn subject_of(raw: &[u8]) -> Option<Name> {
+    let cert = Tlv::parse_all(raw).ok()?.expect(tag::SEQUENCE, "Certificate").ok()?;
+    let tbs = cert.children().ok()?.into_iter().next()?;
+    let mut f = tbs.children().ok()?.into_iter().peekable();
+    if f.peek().is_some_and(|t| t.tag == tag::ctx(0)) {
+        f.next();
+    }
+    // serial, signature algorithm, issuer, validity, then the subject.
+    Name::parse(&f.nth(4)?).ok()
+}
+
+/// The chain from `leaf` up through `pool`, as far as issuers can be found and may issue: each
+/// issuer's key verifies the certificate below it, it is a CA allowed to sign certificates, it
+/// has no critical extension this crate doesn't process (unless it is self-signed), its
+/// `pathLenConstraint` allows the CA certificates below it, and (when `at` is given) it was valid
+/// then. Stops at a self-signed certificate. Certificates embedded in a document are in `pool`
+/// too, so an ordinary end-entity certificate must never be accepted as an issuer.
+pub fn build_chain<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at: Option<Time>) -> Vec<&'a Certificate> {
+    build_chain_noted(leaf, pool, at).0
+}
+
+/// [`build_chain`], and why it stopped where it did if a certificate that matched the issuer by
+/// name and signature was refused.
+pub fn build_chain_noted<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at: Option<Time>) -> (Vec<&'a Certificate>, Option<Refused<'a>>) {
+    let mut chain = vec![leaf];
+    let mut refused = None;
+    while chain.len() < 10 {
+        let Some(&last) = chain.last() else { break };
+        if last.issuer.raw == last.subject.raw {
+            break;
+        }
+        // CA certificates between `last` and the leaf: what a candidate's pathLenConstraint limits.
+        let below = chain.len() - 1;
+        let mut found = None;
+        let mut digest = None;
+        for c in pool.iter().filter(|c| c.subject.raw == last.issuer.raw && !chain.contains(c) && last.signed_by_cached(&c.public_key, &mut digest)) {
+            let why = if !c.may_issue() {
+                Some(RefusedWhy::NotCa)
+            } else if !c.unknown_critical.is_empty() && !c.is_self_signed() {
+                // What such an extension limits (name constraints, policy constraints) would
+                // go unchecked. A self-signed root's extensions are the trust store's business.
+                Some(RefusedWhy::UnknownCritical)
+            } else if c.path_len.is_some_and(|n| below > n as usize) {
+                Some(RefusedWhy::PathLength)
+            } else if at.is_some_and(|t| !c.valid_at(t)) {
+                Some(RefusedWhy::NotValid)
+            } else {
+                None
+            };
+            match why {
+                None => {
+                    found = Some(c);
+                    break;
+                }
+                Some(why) => refused = Some(Refused { why, issuer: c, subject: last }),
+            }
+        }
+        let Some(issuer) = found else { break };
+        refused = None;
+        chain.push(issuer);
+    }
+    (chain, refused)
+}
+
+/// Certificates from a file: DER, or PEM with one or more `CERTIFICATE` blocks (`.cer`, `.crt`,
+/// `.pem`, Acrobat's `.fdf`-free exports), or a PKCS #7 bundle (`.p7b`, `.p7c`) in DER or as a
+/// PEM `PKCS7`/`CMS` block, as Windows, Acrobat and certificate authorities export chains.
+pub fn load_certificates(bytes: &[u8]) -> Result<Vec<Certificate>, Error> {
+    if bytes.first() == Some(&0x30) {
+        // One DER certificate, else a DER bundle; a file that is neither reports the
+        // certificate's error, the common case.
+        return match Certificate::parse(bytes) {
+            Ok(cert) => Ok(vec![cert]),
+            Err(e) => crate::cms::certificate_bundle(bytes).map_err(|_| e),
+        };
+    }
+    let text = String::from_utf8_lossy(bytes);
+    let mut out = Vec::new();
+    // The block being read: its label and its base64 so far.
+    let mut block: Option<(&str, String)> = None;
+    for line in text.lines().map(str::trim) {
+        if let Some(label) = line.strip_prefix("-----BEGIN ").and_then(|l| l.strip_suffix("-----")) {
+            block = matches!(label, "CERTIFICATE" | "PKCS7" | "CMS").then(|| (label, String::new()));
+        } else if let Some(label) = line.strip_prefix("-----END ").and_then(|l| l.strip_suffix("-----")) {
+            // An END that doesn't close the open block ends nothing.
+            if let Some((open, b)) = block.take_if(|(open, _)| *open == label) {
+                let der = base64(&b).ok_or_else(|| Error::Malformed("PEM base64".into()))?;
+                if open == "CERTIFICATE" {
+                    out.push(Certificate::parse(&der)?);
+                } else {
+                    out.extend(crate::cms::certificate_bundle(&der)?);
+                }
+            }
+        } else if let Some((_, b)) = block.as_mut() {
+            b.push_str(line);
+        }
+    }
+    // Certificates before a block that never ends are not a smaller set: the file is damaged.
+    if block.is_some() {
+        return Err(Error::Malformed("a PEM block is not closed".into()));
+    }
+    if out.is_empty() {
+        return Err(Error::Malformed("no certificate found (expected DER, PEM or a PKCS #7 bundle)".into()));
+    }
+    Ok(out)
+}
+
+/// The certificate as PEM text (Export certificate).
+pub fn to_pem(cert: &Certificate) -> String {
+    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let mut s = String::new();
+    for c in cert.raw.chunks(3) {
+        let n = (c[0] as u32) << 16 | (*c.get(1).unwrap_or(&0) as u32) << 8 | *c.get(2).unwrap_or(&0) as u32;
+        for i in 0..4 {
+            s.push(if i <= c.len() { T[(n >> (18 - 6 * i) & 63) as usize] as char } else { '=' });
+        }
+    }
+    let body: Vec<String> = s.as_bytes().chunks(64).map(|l| String::from_utf8_lossy(l).into_owned()).collect();
+    format!("-----BEGIN CERTIFICATE-----\n{}\n-----END CERTIFICATE-----\n", body.join("\n"))
+}
+
+fn base64(s: &str) -> Option<Vec<u8>> {
+    let val = |c: u8| -> Option<u32> {
+        Some(match c {
+            b'A'..=b'Z' => c - b'A',
+            b'a'..=b'z' => c - b'a' + 26,
+            b'0'..=b'9' => c - b'0' + 52,
+            b'+' => 62,
+            b'/' => 63,
+            _ => return None,
+        } as u32)
+    };
+    let digits: Vec<u8> = s.bytes().filter(|c| !c.is_ascii_whitespace() && *c != b'=').collect();
+    let mut out = Vec::with_capacity(digits.len() * 3 / 4);
+    for chunk in digits.chunks(4) {
+        let mut n = 0u32;
+        for (i, c) in chunk.iter().enumerate() {
+            n |= val(*c)? << (18 - 6 * i);
+        }
+        for i in 0..chunk.len().saturating_sub(1) {
+            out.push((n >> (16 - 8 * i)) as u8);
+        }
+    }
+    Some(out)
+}
+
+#[cfg(test)]
+mod xfa_ext_tests {
+    use super::*;
+
+    #[test]
+    fn a_single_uri_crl_distribution_point_is_read() {
+        // The real extnValue of the Entrust Class 3 Client CA: DistributionPoints with one
+        // full-name URI. `fullName [0]` is IMPLICIT over GeneralNames, so with a single
+        // GeneralName there is no inner SEQUENCE — a run of one element.
+        let uri = b"http://crl.entrust.net/2048ca.crl";
+        let value = der::seq(&[&der::seq(&[&der::tlv(tag::ctx(0), &der::tlv(tag::ctx(0), &der::tlv(tag::ctx_prim(6), uri)))])]);
+        let wrapped = der::tlv(tag::OCTET_STRING, &value);
+        let extn = Tlv::parse_all(&wrapped).unwrap();
+        let mut ext = Extensions::default();
+        ext.read("2.5.29.31", &extn);
+        assert_eq!(ext.crl_urls, vec!["http://crl.entrust.net/2048ca.crl".to_string()]);
+        // Two URIs in one full-name run.
+        let names = [der::tlv(tag::ctx_prim(6), uri), der::tlv(tag::ctx_prim(6), b"http://crl2.example/x.crl")].concat();
+        let two = der::seq(&[&der::seq(&[&der::tlv(tag::ctx(0), &der::tlv(tag::ctx(0), &names))])]);
+        let wrapped = der::tlv(tag::OCTET_STRING, &two);
+        let extn = Tlv::parse_all(&wrapped).unwrap();
+        let mut ext = Extensions::default();
+        ext.read("2.5.29.31", &extn);
+        assert_eq!(ext.crl_urls.len(), 2);
+    }
+
+    #[test]
+    fn a_malformed_extension_is_skipped_not_fatal() {
+        for garbage in [b"".as_slice(), &[0xFF, 0xFF, 0xFF], &[0x30, 0x99], b"not der"] {
+            let wrapped = der::tlv(tag::OCTET_STRING, garbage);
+            let extn = Tlv::parse_all(&wrapped).unwrap();
+            for oid in ["2.5.29.19", "2.5.29.15", "2.5.29.14", "2.5.29.35", "2.5.29.37", "1.3.6.1.5.5.7.1.1", "2.5.29.31"] {
+                let mut ext = Extensions::default();
+                ext.read(oid, &extn); // must not panic and must leave defaults
+                assert!(ext.ocsp_urls.is_empty() && ext.crl_urls.is_empty() && !ext.is_ca);
+            }
+        }
+    }
+}
diff --git a/crates/pkcs7/tests/data/README.md b/crates/pkcs7/tests/data/README.md
new file mode 100644
index 000000000..9e5ebff1d
--- /dev/null
+++ b/crates/pkcs7/tests/data/README.md
@@ -0,0 +1,62 @@
+# Test data
+
+Test-only keys and certificates, generated for these tests with OpenSSL 3. They protect nothing.
+The password of every `.p12` is `test`.
+
+| File | What |
+|---|---|
+| `rsa-aes.p12` | RSA 2048 self-signed "Test Signer RSA"; PBES2 AES-256-CBC, SHA-256 MAC (OpenSSL 3 default) |
+| `rsa-legacy.p12` | the same key and certificate; RC2-40 certificates, 3DES key, SHA-1 MAC (`-legacy`) |
+| `ec-p256.p12` | P-256 self-signed "Test Signer EC", no friendly name |
+| `ec-legacy.p12` | `ec-p256.p12` re-exported with `-legacy` (3DES, SHA-1 MAC): the format macOS `security import` accepts |
+| `ec-p384.p12` | P-384 self-signed "Test Signer P384"; AES-128-CBC, SHA-1 MAC |
+| `chain.p12` | RSA 2048 "Ada Lovelace" issued by a P-256 test root, chain included |
+| `chain-legacy.p12` | `chain.p12` re-exported with `-legacy`, for the Keychain tests |
+| `rsa.crt.pem`, `ca.crt.pem` | the RSA certificate and the test root alone |
+
+Regenerate with:
+
+```sh
+openssl req -x509 -newkey rsa:2048 -nodes -keyout rsa.key -out rsa.crt -days 3650 -subj "/CN=Test Signer RSA/O=PrintCraft Tests/C=US" -set_serial 1001
+openssl pkcs12 -export -inkey rsa.key -in rsa.crt -out rsa-aes.p12 -passout pass:test -name "Test Signer RSA"
+openssl pkcs12 -export -legacy -inkey rsa.key -in rsa.crt -out rsa-legacy.p12 -passout pass:test -name "Test Signer RSA"
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout ec.key -out ec.crt -days 3650 -subj "/CN=Test Signer EC/O=PrintCraft Tests" -set_serial 2002
+openssl pkcs12 -export -inkey ec.key -in ec.crt -out ec-p256.p12 -passout pass:test
+openssl pkcs12 -export -legacy -inkey ec.key -in ec.crt -out ec-legacy.p12 -passout pass:test -name "Test Signer EC"
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-384 -nodes -keyout ec3.key -out ec3.crt -days 3650 -subj "/CN=Test Signer P384" -set_serial 3003
+openssl pkcs12 -export -inkey ec3.key -in ec3.crt -out ec-p384.p12 -passout pass:test -certpbe AES-128-CBC -keypbe AES-128-CBC -macalg sha1
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout ca.key -out ca.crt -days 3650 -subj "/CN=PrintCraft Test Root CA/O=PrintCraft Tests" -set_serial 1 -addext "basicConstraints=critical,CA:TRUE" -addext "keyUsage=critical,keyCertSign,cRLSign"
+openssl req -newkey rsa:2048 -nodes -keyout leaf.key -out leaf.csr -subj "/CN=Ada Lovelace/O=PrintCraft Tests/emailAddress=ada@example.com"
+printf "basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,nonRepudiation\n" > leaf.ext
+openssl x509 -req -in leaf.csr -CA ca.crt -CAkey ca.key -set_serial 77 -days 3650 -extfile leaf.ext -out leaf.crt
+openssl pkcs12 -export -inkey leaf.key -in leaf.crt -certfile ca.crt -out chain.p12 -passout pass:test -name "Ada Lovelace"
+openssl pkcs12 -export -legacy -inkey leaf.key -in leaf.crt -certfile ca.crt -out chain-legacy.p12 -passout pass:test -name "Ada Lovelace"
+```
+
+### RSA signature variants (hex constants in `tests/it/crypto.rs`)
+
+Over SHA-256("hello") with the key of `rsa-aes.p12`:
+`openssl dgst -sha256 -sign rsa.key` (standard DigestInfo); `openssl pkeyutl -sign -pkeyopt rsa_padding_mode:pkcs1`
+over a hand-built DigestInfo without the NULL parameter, and over the bare digest;
+`openssl dgst -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:0 -sign rsa.key`.
+
+### Other algorithms (hex constants in `tests/it/algorithms.rs`)
+
+All sign the message `hello` with throw-away keys, OpenSSL 3.6. RSA ones use the key of `rsa-aes.p12`.
+
+```sh
+cms() { openssl cms -sign -binary -in msg -outform DER "$@"; }
+cms -md sha3-256   -signer rsa.crt -inkey rsa.key -out c_rsa_sha3_256.der
+cms -md sha512-256 -signer rsa.crt -inkey rsa.key -out c_rsa_sha512_256.der
+cms -provider legacy -provider default -md ripemd160 -signer rsa.crt -inkey rsa.key -out c_rsa_ripemd160.der
+cms -md sha256 -signer rsa.crt -inkey rsa.key -keyopt rsa_padding_mode:pss -keyopt rsa_mgf1_md:sha1 -keyopt rsa_pss_saltlen:20 -out c_pss_sha256_mgf1sha1_salt20.der
+cms -md sha384 -signer rsa.crt -inkey rsa.key -keyopt rsa_padding_mode:pss -keyopt rsa_mgf1_md:sha256 -keyopt rsa_pss_saltlen:0 -out c_pss_sha384_mgf1sha256_salt0.der
+openssl req -x509 -newkey ed25519 -nodes -keyout ed.key -out ed.crt -subj "/CN=Test Signer Ed25519"
+cms -md sha512 -signer ed.crt -inkey ed.key -out c_ed25519.der
+openssl ecparam -name brainpoolP512r1 -genkey -noout -out bp512.key
+openssl req -x509 -new -key bp512.key -sha512 -out bp512.crt -subj "/CN=Test Signer BP512"
+cms -md sha512   -signer bp512.crt -inkey bp512.key -out c_bp512_sha512.der
+cms -md sha3-256 -signer bp512.crt -inkey bp512.key -out c_bp512_sha3_256.der
+openssl dgst -sha3-256   -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 -sign rsa.key -out pss_sha3_256.sig msg
+openssl dgst -sha512-256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:0  -sign rsa.key -out pss_sha512_256.sig msg
+```
diff --git a/crates/pkcs7/tests/data/ca.crt.pem b/crates/pkcs7/tests/data/ca.crt.pem
new file mode 100644
index 000000000..2eb1f3618
--- /dev/null
+++ b/crates/pkcs7/tests/data/ca.crt.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIByzCCAXKgAwIBAgIBATAKBggqhkjOPQQDAjA9MSAwHgYDVQQDDBdQcmludENy
+YWZ0IFRlc3QgUm9vdCBDQTEZMBcGA1UECgwQUHJpbnRDcmFmdCBUZXN0czAeFw0y
+NjEwMDIwNjE3NDlaFw0zNjA5MjkwNjE3NDlaMD0xIDAeBgNVBAMMF1ByaW50Q3Jh
+ZnQgVGVzdCBSb290IENBMRkwFwYDVQQKDBBQcmludENyYWZ0IFRlc3RzMFkwEwYH
+KoZIzj0CAQYIKoZIzj0DAQcDQgAEHzN6qxrMUelog5zRgDla65Dp0XLVvK+0I/0M
+uNhWDorE1CqrUrVqLkYBPSIWFfu36o0h5vF3RI0JBq932TsrS6NjMGEwHQYDVR0O
+BBYEFENYzD54+vd7a43BOQZRdfvhb8DwMB8GA1UdIwQYMBaAFENYzD54+vd7a43B
+OQZRdfvhb8DwMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqG
+SM49BAMCA0cAMEQCIAR4KSUsZM8EG6IiDCtbVvF7aadd652Hbs5ZVguYAJYPAiAX
+zSun5lH712+mzakkZtbfhuutsYYliZt84UuiSI+SpA==
+-----END CERTIFICATE-----
diff --git a/crates/pkcs7/tests/data/chain-legacy.p12 b/crates/pkcs7/tests/data/chain-legacy.p12
new file mode 100644
index 0000000000000000000000000000000000000000..6a11065ca02d01319c5780448477e72b90039974
GIT binary patch
literal 2878
zcmY+^cRU-476<Tzgd%1U)K)7R7im#@@2agrZ4t9(ty(c^r$)K<2o-88rG#3wg?q11
zX>C<nY80&+&;5Mfd-uIR&gXp2@0`#1^DBj+Q=kA+N?~Y!P|?5=^%76$fz-e<4DA*O
zL%VSmuSj9QkN#Ovm0`e+SCJhB5OCEj|JeYgxT$FW{Q&}`l41Z|dtv3~5Wz&*NkMT9
z5Q71WdFDR%oaocAv`zU~WQgXi#&15C3;V;KpHen#=mgelfqhE=f5&j%qzJkwoSH?_
zb@I(@SibN7P95I|iHvy$L>Q7ulh0FCTc32+6=7mS8O02i6V@US>9VGBTd8{a?aZUy
z+R6koe!hB}*Z_{psBg&|>pdb8*FY^baqS3fjob0Mf9&`hE`@jNblN?=9-^`kFK$Y=
zoG_Bj%+Yrt3PM2frw_E5tAz$3jA#M!eS1lm@MtlXbXd;tAy7=@SX1@o5g*%H%i)Fx
z#J2Zjq&)gV;kTN}4L4p%URjOr0cVx9vqg4LpKNzp21pl&-#cG#(|wNsY6F2ZNk%E;
zn%PEEAl0<4>9~86v*PH(`twbJrVdf62w>}=3w*%`^70FI_npQ2H)D47{`X-%>tvP7
z@Zi`_puQIeWOUl_Skx;YR<oLu5E>DFJsn(bw9BQQxqvWWNs<44P*N%T>QiRZF4^@~
z;fYWXUKC)Wq97><H=##18UAS9X&fJWnHk(L>y&P+HOcvBAL97h>RMm&z}Timl9`@1
z1BXoI#;4#2%i)NGk_VzCq)CXd2et5y=DZuJbO#z$!A(SIsM`?Kv|=UnXf!%$p_-QX
zTQXSuXOQ%vT5h!X!g3Zp35Z$<Ip=BGd!qE=Sp`y*h__UBDvq1o(uZ=@{bjIP`GP^H
z8BHPnHNHneY+U<vsltl)76Vv(zp)yaoN6hw#J6qCQu%95Bkon>Ks<tVDg@HbSmMK_
zjH_8>e)f$G=!$x6o2G7C#Z)*1FqdD@r+Fq|Dfp*QtPB<O&GJeIS;-UDt0kyrnuKHW
zUK77AufbyX<%WbL%o@dI_duqoC0|c3m^J8>KnbYh79%&KRHicya>3eR6HK%bSgl{U
zs+nuuB6hy({e!=0>gXfD&&@^pCK?7@JfTZbb#sl%^n4?sdFa^~dcN+QuF?9A(NpVr
zd=UPHYZLsBjF5Ig_Ipki^6`7|vj>$NOYhrRN*9~LZxRDDw5J@|O^NF_;603w@k(P9
z(GMYfhoDPdKf!5dc=#v9dNO+;jM%cp$sr8RO<u}a!NbmmIl0;USC98^>xi{>mUl9l
zk7b=3^(5%@>kh`q^5v{j7h`s;7E!L%x+zR!V6q~i?tlaP<fUdC%iF-?=yy0Y_D4rO
zaVFE5aZSlYVMj7OT};SipxB`chV!{Ol~%h{W{bB+4pNOL8f^gss2cYX83aq5X2&d!
zCWS!UcQ%N-C?lF`_^rqBua;N0{#9(}vBBD|QljjxP;9)f#@gnEf2)P~>CIN*`e1GA
z4Hwq%2-S#dZ(3??X+~si$)v1zDw}I|GED`a1H~@jF)J}<yZ2t}tr#h$Lr6LZ@wPnz
z>q8+S`lADOZtQ%2_l_8pXjhk!e;FiZg8wDqL|90#%9f{LpU%WiO2gYFro)aMFEWkZ
z4C|_bn5#AUEP7pBfOH*GKzP>;yL<=YVyBApBG2);@bCbNi|Q%V|H#DdVh-Q-=1e9*
zbfzlz`u4dTr6M*roL0z-ZfuK-CiyF>%rfZk44%hcAK7!!&s!oe?h%FU2A~kX8!tc#
zxPIAdyR^O!RTqFz!WHg=?qogJ-DubE-YD3tn%OM-y-N^nQP@BYUS<=_JYsPtTU%S0
zGo*=fj+v2u(i0>9u)y(R&-_nt4jF!Qm?Bh`lI-=<=!D|7G+h&@l?sb&S?<Q3GP!Ot
zZ%+A+@z;_B?@`*Qr8E^L{VP~K{|DA9a&18vu=Q1JepUCW=>EejEs&xN1KO3sfVTfn
zU&_DrjgM{e&@I$q|65-W1~g*vP*~hJUD>bl%SGt#hOdlJapPqv<>6nIY;2iZWpRO=
zost(!5cJ$l&{}4N0h+3*MrFC8b3YHj`7@Wa7Tlj#-r|{#?Hwx6D|P0mony5z)3FNG
zRCevjy?v^r=-#Grtzlg=f@{#UKWtP!c3E`~*G$w)X-f~e;l9tG;wk7rt;2cSL=tcK
zz6tnJKxZ}hb9oZ(XE`^CChj1sbJHHV2avbEuSjU-EkVRZ=DKI(G5Bj6(>>Ip(==!(
zNu57DD2Y;?&xx6IC%%sKYQU8Hn&?7Tdq?eO)pFw1S`(85?hZ~nol}!kehCVnTFv$-
zThYV=kCWN~0Tz@`5h9G%6^<|Th4C_P9gn$g#^t5|wr#B4_X=oZ%E{UYL9W=r_<-u+
z-V8O{utwV3duVQ_)@}=I(E$u{dYCZGqDhfhGEt7w6XIWQ7h&Z5%pB+b2+WLKVtk-Z
z@qBE?P{|^Ll!hiNM3UZy6Q#9X=ZX*P{2e*&UZyyw#bhn9Xb?``-Zk6Qnyf(wC>zEP
zm9#FE>-r_+eqB+QI(3@QUMO?DRGgbE2#syN*Oax#q&HtA_mStP%t+)!YTps(fZEOI
zlo6W@!rsoA6qIeMcwsVKu6{%EV;oXCF|k!ivT_vGuF5f=bfdsLbn91M#r6l}xPf)v
zdz-l-CJvi%;7Ci?lb(y+Cu?%v;_X%+7O%%<Ly=>2Pc*YzYd^!BTwm`rv~=j5oGJvh
zxkRAdbQWsgO~4;l@RTy_kkwx)ijqlWSP1r(PBTVThTwn3Fj#3IS(>+B#Fy(&8hV8E
zqPjedouf3v|1cP=r`o1%^NWz|KMXTwuYd%Y(V?Pm92cXXy2U;i=4*BsUGJNAK;wdK
z4^N89czf`DwF3_ny`=Pcfac~gPp{8ClMncdr(0k6PAP@;xIf&pN^_N^stir@M0P0O
zb716EoCT>unBisq!rL`Sgw+gmHGf*|oOVfvqiVAda>wX{NYC)G)ueKjIIQ|b8^^Fa
zX*gyBO4`_p?NG^`gl8<b%<6nS(XaL+cBD59vFI}Ij>`AWHS?|Y&}TRMNYdRgaM%{?
z_k?_7Mf$24?v(U@f=5kW#0(Wm?*{goG~mMYzsTT_w|4RGDv~eDG2=Ft_B2p3vXs-T
zIA0@j_jyr?{RSpMFU0$tZKn7;<$U!G>QS?J(@NyT42$&2y0!9@Eqjn#SC~;#C^3a6
z_7;V!W7|zOZ_W#GR9nx?f(_Jd%U|+Lkt>FUEyB?^J53u~<IZ?%$J4B4GDrWG>B>sH
zV!qhfXqiO88y#6kN~07<7;<dzJV!?uPj&+L$Q4W=DpEM^AqH}M6I53Tf-7G6hRh6F
zK^gEb?nAXhj;re0x+N<wR);aO0u)gmkwYfxo7Za?gU{Tek@Sl$TAx_dzdg{NdTgxU
zXS^;Z=A%2geF^)T8JA!P-!kX1&Pr_8EeLGRA5#{X8C6T_0+$4^4qg{`7-Tov-*h;6
zSLnXn+MCbB9=gR$@?HEb^<nBUA9KAGa=r$xL~2J}ZldMF3xuac+Gxv?Pj5rUv~PQ1
zQwe5h?H}2C$p}}G*qqju(fp5|TY0kg1RWlKdSAN?0aKe9Bw=J!>shW*NgGQE{Z~gC
zHfeSctJNd5FB|DeBBGM4M=<8h;!;D?0V&acj##C+csT&-09Sw$fFEE4cm#M1a07T>
zO)da8sk>4FQZ!Ux2?k0EE-(PZ3aW%>**UlL`zCm;1)$yPIHO*%f|#mCmMLFW?I`=v
No$K?29+CfM^<O^>JNW<r

literal 0
HcmV?d00001

diff --git a/crates/pkcs7/tests/data/chain.p12 b/crates/pkcs7/tests/data/chain.p12
new file mode 100644
index 0000000000000000000000000000000000000000..0cd7ab8c3b157902cc7c3f64e1e47ea3cf25c655
GIT binary patch
literal 3044
zcmai$c{CJy8^>oyhGflH!Z4PinV~Exq8P>&#x@y)v4m?G*|&@+yOK3BL-w+}N%rQt
z_N8SiYu&O8O7>EC-SfVu{(S%Vo#%W%-{+j)f1mT9Y25EYKroudod)AlO28%T@Blf0
zbQ*UIgvK3lh(pjcXzT9^MyElm4^cS?2sj+{-whD$^eaGl(3WV-?+8cBLimK2I%HY)
zs*N1R8{OBnt=d2!P5>GX<NWWhATB5XEdk>qC*Xi?U<gnN!WWBe2x=jg<u}+xyb-Gs
z>b^mPqFb5D^8!Zw&!wXmW@mzT+L_54PTCs|>u3K|C=-ePV59ctg8uFMxuIDc0r&Qv
zoghy1&n6E@Oy_FzY@B0PcKfO29k{Ao`>YP0P*xu;@FF>jf9^DF$?YV+d@3*VUelMg
zR{P1Julak!yoa4NV)?*A)ts+d!C8mm$jjgUwZT=AA1gI!Z7_q3N;Iq~4VqHR`HQb>
zd3T0u==k{xYOEg(&@nRo^=5r@S)KVQ%dzU{TW*|RmClN~Y&P2keNrPYcY@w&JB({J
zc2H(oHA`k*H-0ZUGY*;Nvq?7)RGdik&P}`!>Djh@FORztAtAFS{c^QLHYkLXvpsSA
z>moyD(=dJf(%XVGQRU1YV6wp6oOMQJ(UJDh5B}1R+_YJjC_qKA$0^e0@x|ABFJQYK
zhLbD~G<M7n&f2zrFsF^a@TiI@NcwRZ`9t8u^}y-^T#AtBX+nKlj#ieg0%HzkS7>w!
zRpd98NoKOn?U(Fs`(NTxzjM{%=~i!@^m!qVe)du5^2E*6du{O*y$6?j<P6DnQ9hkz
zt$7x#*jx$Y%5MElwT1}s6Km#O)uovjeF{q7cfD}C+1zy>@$L5e1c!)MqgQgO#$JV~
z746cG?vho?I%Y4zjk?H-i~!jHQ?$M`LlYO-TloPWXH0B%PYP+Tjh~^h`?Q^QAed@3
zk$9ytl<P>tn&qB_;+37c!eFu|O{e4GKB_2I&;&{U4wO~%<q!71Ao8Hpwq&SvmDh;*
zz%8w~GZ!7=6m;*T%Smw@IO^eL%9iMjWLYVKVUTf#lUG&7^{^Vqbm~%-v(s8ERM*ZW
zBQM-J0wG}^i59R{6Av5)d>Q5&2u(d50A3~z1_k+=iFWj+B(jW*mzp-<cdmBn*Y>yd
z&(!atga&HDeYDbP23Qj}eEPzL2#>l>I!?6FW>fEO_j=N3?^asU8<LWn8Bb3*`Dows
zAHAD<1+vQ-DQ9T@UHlcce^6&XhO$4V>rJ9OUowcRtSng311jJhuM^`~6ZP`9tv~u!
zipDt+z}lTtrfne&3<XcpP(zKLJV&@~nf8K)O-6~z@geW*M}ludt+~XF=0_wef+e}Z
zn4I{Q$HSWPBJ4eyXE6j)4rZRkVmYrf9;4)(F&l6(Q0j7v-<PGp=9Wj$Do<?HJz%VJ
zR!gZr^xAGxBIj4#Zo=Kd@|1f5nC-x<KwHD+K!u0?gLn1pU%1VYV+RKi1d*%+jkj83
zisb&gy$HDZx@if{CVRi)<cm7tIIG9m%#_l}#Z%jjyO@ljEHav`8D_AfQWdtCT&nam
zSn9rfrYP+FfUa^w?bZz)MD8U=%Pw<P^S;Ij`9@E3p;AVy>yt>+CGi4B-W5BgpL8Te
z<Ax8oclL6c+tgG0aEcox&JssPA-OhIyor&a8rr~-hoN7h`L|>wUN(rqD5-|uK&$lQ
zo#WTVKa887f5u@&E?lX^i&d+;gbq*5DI2$X-{fXrnwlgy9cW6u=2(!!Umm_PW(AJ~
zG$tF?5rL2h^H-#692R}o{^Y(wU}*Z3QcO#I^K*VyL-|jrXAlpF;5@b*QuFWcjV)h3
z+n9|xeg}?xsF;=%u2BhdMR#aL?h5L>iTOlvCeu!s1)>Yxlc=Dy=obyqQmNIi!%X&7
zb}OFB3>Zgg9i)_;OiWxH%<lK>y@~T!hIVX6ik}38FEs+jOA8VBfaAka+4V*Z9>59H
z=D`P(X%D)81Poz<-KVjV3~;EZc_}uTQ^rwcXA%{C?$FWAzdZb}*r8<*8npNjKRA5(
zFz)|3AASS~IxIC0;hFy@a!S*tQK2?w1d7XK-wu49_kTs+vQ)yhO(-Y?r#h^EhI{Ej
zXpk`^OwZDl>To0_>#W8w_+5*>k=g*!vQ5&1P?Uy>dyV&Uj2_~hd(y|y(eA4iyS7b?
zY@Buq%3T_jtG5qzDZbpt33oqJu1VdQl<u{nKZZ%9^>}Ew&+Ng4s{P)YG`+U*scZlK
zOe47d`&D-d6Ws+6PB%#AjAM!9E!NB)3;INA3@p`^FMs1ti;0_N`?y8nBn-%RL3b(E
zbv4cCCf&BBXsZ7X7<2XX>Mq9$uA1ylm~s<7`F7zny!;u~L#U^zlvo+AC@XqKXzq@%
z>2g{&V5pG=J3WpiUG?RC{Yn?V=73LrpZc8u-1hupvWWl2?X_An)2(3DoG7PMSwjnt
zkkf<t)(FQ*^qu%YUAvWBq#7aq1}nQm45o+?=H;iCS<UzCj;&9%WXibaHMg2w2%j35
zFY+RW<R4?G6Yai81%ae^E_i7bCi}+Wixb$&)?*vI-Z$=R&&Ee^z^8s{Eq_uw<*xhW
zBSzfq^b*e(YESuHtr0ec-O=9kbyfInj6f-AICj${yRzkjG;0=D{wf03*5Rz-bL@;j
zd}Wf*F4CrILqpOyXg<{~aMU`!G3=RGR6?dkAyv`rSV~o}$eq}zXX0xyokFh=bVZ=x
zAm`2+HpA_k7y>Q3K+jU6x=vr+xId1(ztbilJwzdevy{q?(@)z&SU-6IYk$<IKhC8n
z{PWg<nW`^5*_sg~ige%dPxM~sO6C>Rgvf*_4;3@RGf59?40XsC;f<kwpo=N<G|`{^
zp7!@0k61~pzNze)<!dKOs9LTZSid-5VWg9m#kPHc&1;e=*`6CyEiz2nTe$%T)fzZC
zEH0Yh)H4-$?Fm2Yb-qzk2{#wKf`mF*AvouwCEzIY<u`^FySwr*9SiL;&2v-dD^}|I
z%;EO!J;1XDHlNO-q`*glv40^Y!6iHnnMzLfO!k$;wA}a%&#*+mHblpd#54FV_T|vC
z6%cj*$<%|Xa--5Cs>s?auJ-)ds4XcJFEiND+BK49*8axiqLfXsMZVAS`|<Emossi%
z7LKhg`FIp3L$cLRwen6nquObMdGuIUX9)ifY_<z?uy>CWTlwNHr{RJMK5ZQbL)BVF
z)Np0rX4;r)OjS3eH84e2bI&g~y@XTt=$V^F)cw~{(`EW9h@s6+OhCtm;mD%@IjQ6V
zFu`$Kv$etn^=`8(HEU8`8Zlx;m<Zmw22g#3*XCO>4m`3~ckQA<VN$6~lsJgQ{H6yN
z?iM21c6LUji+oleAQWrq6=D0S0(tg)gh}^`^l(=9lNR-Iy<3n={!P&e-@>>QAG4|G
zd{<}*iF(jT+tGBTz>)Nl*<yMQFTc`Rtv|y5_Ei=AtUO)BI~uGhg1pt9AjB-X77!gN
zSET1l$&$nyba<C?6UE;jj3vSC+~)Ul=ILsJ@;MLHVd~X{+mgN{mrfY_RIl?2fFLwM
zoQfN&Q`jnq*fmh~{xGcmF~FrJd8OYVjvVdz2q`EnN>sy3PhTwY-lo)ZJIis;el*jP
z7~gp0B@bw7RzqLl4oy6tc;oT9vHZ{Mi&f1SulsTGtgq{Or1eF{KfH+9>wIH(?<82n
zY%|E-sN_MbeZ@)tyX*OX3wM*{3>yU_QC9^-x@d?6uO}H8Gc@v-Xt{(i!Vp0lKi%cI
z)Y~X|6~Qf~V|NOR@K>Ir<$o^;Vi1zY0T%%jfHOb}U;^+11OwavK8MK_;D$CrW6(Um
z?qLuR3V=vmf3Evi%tKZ2e`G{<dd3<Oonq$O27)wtNS`;!i@PgU5Wb|s<1tdcr;_HG
Nf-*)D&GdiW{2!Y&aSZ?f

literal 0
HcmV?d00001

diff --git a/crates/pkcs7/tests/data/ec-legacy.p12 b/crates/pkcs7/tests/data/ec-legacy.p12
new file mode 100644
index 0000000000000000000000000000000000000000..caf621189289f3b31928f3c597dfd8598c977717
GIT binary patch
literal 1047
zcmXqLVi9IyWHxAGzR1R@)#lOmotKfFaX}OFA(kfQeL&$|22D)$2r0G&O-uzqp&TYg
z1|XG+kYO~CVdH|Dz{AL9z{kSzS9$W`oW~^zOiUaM4NXiIoHrIUZQg(T!~aR`>s9A}
zP4~!Dt(a{zqouMTg)cI2-JG>|v^E9q-u`X9dd@!{FEg2U(h;m*OHQ<g=f{0dv);S6
zBestt-R5VWf8MuFojXfIxn<c(&wQK2(-V|icl7_HgZcAR4~k4Mxg|Dn!}I!|PCI3~
z+kH+5mYW|x;+&lQcv6qtm4bWrMqii3rC$A7{)5Zg<Jsbg+Rx9t*(@fvPH4gG)66$#
z<R8#W?0?o#ye6b!anO;r8{wa))vS!^?daN-CwyLEkG<ENH%fXg@eMKR##0OGYMpQ8
z7p^!lEl+j6#*Q9~`*xr7XFYpht@E{Ub^oC~5lzz{&wcZJ{p0S#?|Em=n$f9a&ilJ}
z-i}**51CpF*E_Pd?pn_>)BoJhox8sI*yR_+Dq7Zu6i?pJVD()2aPiaRH!nGJwy-_f
z-7nVFfBF9x`(IM&(+XSm^6N|M_p=pPR2RkEv_09<_bYiZ*Oy6Qi^9HKPU-vqI(X)s
zsn*&LH`XrBE7Re8vHs!8`<b(KBOA8;lKGh!e>m~Xj!^CW>+7O)mmGR>_07#USF#uu
z-evS-dALo>Rm7q)ZP}$<UB#LXTgzwb>#x0yyLrF2!EI`%YW2Np-M?Ndbv<tLS&H7S
zkBe|?=Bx_Jzf^oxL9)p=*Y&e&azWCwXhykIHpX`nH;#y&Y&ol+cyps&?}V)lGcJ@Y
zOFaGUkf>|<!@O%}AGTRdZ~48r`s_6SnNDX@J#&7wcdk|xUa!mQ-p5g4b|k1uf8~lj
zv4MP2|14Z*ItCduF&ZN!v;|F!DlAQm3P52QAeLa`h9x^LMy3UgTMQaEqNGJ;P+C0T
ztI=0$xv~M27Fil6Xm1WLoy;E=8}^}VWiyvb#7Tz9{O=9+M*M%A#Q$NlfO%0@)$G@+
zrtH$((KD$qW!d$4Wx@g{68CSo!ck?Cuh7~1*Wdy7iX)P;B3#pWO+G~kzby}Zck%eE
zpJG2fBRNWUANuxip7w3MnI*A$-f}^#ZF~NvtWbY>CNMu|<E>R&OiEOrDYS}Z9$(yY
zB1(`k?T$d2VUU3`+>4x|hGHxt781)=Ypy82xb&R6w?%4=uIB=~JqFqcMIwfBaxx4d
z45<vo3?&Q-48aVU4CxGcKz<RB=gQ!0U}>Oez{$p{&Bx3n#mc}UQoiiuqpw@CvVIE)
k{pLFKQug&$wm&Qa0=Mn%uMuyK<VyR&Dsb)NR8R;3006<lKL7v#

literal 0
HcmV?d00001

diff --git a/crates/pkcs7/tests/data/ec-p256.p12 b/crates/pkcs7/tests/data/ec-p256.p12
new file mode 100644
index 0000000000000000000000000000000000000000..a859c7eb215e20277d4b86d5844fa7ead28ca729
GIT binary patch
literal 1112
zcmXqLVhLelWHxAGVPfOdYV&CO&dbQoxS)yoGfNZmdxIwC*9J{Yvk+2j3!0d^fkN#}
zj0`}k0U^U^5D(|D@)`sg7$Uel1}ZE9P4YU$Yj@0DrFUre+5I(ftxQZD3<f-G91vTX
zI9VACWZ5_q+B_IjnOPXMSOl_~oN^Uz?r=JwsPS)23zK|96O+KfmJ^#g<z8Ij7JGX=
zUF~(}@;h<@hg>G_vf5V2EICm|RZX&J^Q)yVCclpf5Wl=d?_l=6eT%;Q{p_yO9B?w$
zrF_DYqkr#($8XzwL}<kx*HBk|*|?I{<@Vo#x;q4KKYJhgpyk-_<+Y*q*NueZx-zb6
zTyHQsZ@fy+ODX-h1ScC0=K|R{uFA_PE*z2DYEt|r_2fy&v-L?|ZZzUgcrjP)U9+3x
zkp;ZonNpt8D<7S6J-Mhe;;+q{CE5$3){B^%-Sg#+x@xj+hRRIUo0j|MO1EarSO3G4
zJ=L^-?Y3*j?j<tH&N^;%M77hm^WJ&C3CuI+u*}Kc!Y$*Px9Nn`kzWy8Epl$W^|}?`
zaz1k5;hZzfOC}UNTbmj4Y0|@7relg#YbAqb9p1R^YTv6{b!yk*CQO&`dlV_Kj7!wG
z!RVvKGj~_!+(~M(jKURd$_6*CTDsI39uN~}Z&9^rn4DadvCL{u=##CpHRsQ1wz_>d
z`00;tMj6xAR{MU*bu^S;yTnwJhq1`@*?|smgZ=^^*E>9p^NxIcaBTI_ePMQ=0|nb(
zYot1Eo$|kCX1ceI;3pSJ&ye(^SFRmw`nW+T^v^<XkGjGKTHaj#`*`#wWUaRUyf;;$
zT&?h--P^>Srd<jFzvF_1k~e+Ovr}oj(R5`g<Nsf`Zm!w(@sy`;nVPooL(VC0)-Dls
zSBw@2JU;8tr0wM%)0P}r^EjxM^<IrZ6Qd_Qoq-ZAqZLaNqZv@x2#EFAxS?s9hl`PE
zLF0FW#xI1DDeE>F!`-{@@Vva$v+o{H^96#*ROOu0RgE2z^Jf%^UG4aj{DY-&Lc9B<
zCs%#Bt{H4Lzus7N<IX-iCWU)4=frESSUtQl;YHME_GvxWKAO+FdcR}KQ(sO`?(nl|
zOa8^$RX87G^xkxQ)8$L-iVQ+)Sa-dC)NeH{{G;L3C5IkQu={Z^<x-u_YcJXSLaB8N
zQ%xQ{S8lS;QA%rkxY=xD%Cz#my5V`pGS7V2$UFCK+VMRbzs&A;lb9-ZafYF)figUl
zI7JP`SVSx&maW!YQGRjhId^Z1)EZsS1$KK3JPiyDc;R`FiIJ6oML~M?bk`Z)<rg)~
xg)UUvFW54{=zmA+AGYs;lX$rfNW^ur2(&yo<rkKBwsqr!mz7f6_B;ZG7yupR&iw!Y

literal 0
HcmV?d00001

diff --git a/crates/pkcs7/tests/data/ec-p384.p12 b/crates/pkcs7/tests/data/ec-p384.p12
new file mode 100644
index 0000000000000000000000000000000000000000..14b5eb4bdfb6f6dd4d551c4737fa5fcb4d70c192
GIT binary patch
literal 1162
zcmXqLVrgSyWHxAGabe@sYV&CO&dbQoxS)x}l%<Kq5Gbr`(8RO~A;q?!iD@=aXgU)k
z1CW}4kYO~4hjUnY4T1~|5nLVv6&3--vK{lbv8`OT?wt@<Zu9?3OiUaM20UyW5L=lz
zSs4su**Fv0JQ!1%Ss0mE1on0pd^%usp#7WCgw@WLQhyqnm=ugEet%Wjx?m@J$(@9-
z$~i(0b6T#S@D1e@j=1J3Qu+4ls&}WR9qoMiu<AfkX4PbVxutuLKX&}I@MDtwY2W<*
zsS6+UDDSv@ey^=KTkJufP239Ze}uKdB@*S$8IN(f1$A904c6>ftJ1;|b~eOHGA-Kc
z?<%WFr`u+(Oi{bYw8)P)_t+YhrW@aUZy(vk(X{p3H%^PyDQ(TQ8?JuSYBSi>?6j<@
zWU0Sls+?An`@hwW{K0YwMZ)=i@8tQZi&$4D)f8=*_Nex=gyHJHZ$JGsdN_l*Xp`g-
zwa3M#J49QoqRxAL5AQuAxJcy-+y0H8GFuW%mw!AJbMHW8tw6)l(C_cJZQh|8|GCh2
zib_!Xuh&NwT;26#`po%qJneE5H!N+x>`<|Q;}PrQ-P{jD*B$=;r7LJ%%BCrY=K8)n
zrx~5x%lD9J*UXnQGjh}Pk7!#9$R9CSVIec2-uq<19`COas?xV)OPDhr*#1^x3yEK>
zSWq9kbyiFH&h@ueU*BNv#1NpU=$aDXx=`3e^+ddS#k|XQ2W0a&YQO9@F{xbfxvJ%|
zzmjlnME;)NtK=T<vRqfIu<W?N7v6J!B<CMHc15hEV8Y}rUfyDYtR<2Ue(yOa=HAR>
z_)mmqYlxlLoc$Z$p9@|7|I?#fyROB$wyR@5wmeF%J(_xCR-4M3)!(+R`Je4s`Fgh*
zcUQwDxsKI4?sHCbZx`n>>DcZvGoazsS0(EZQ$^*{kV(&v3f|vr(8O2`Pj{e%%$UQ{
z#FzmTP66TsHg0Gd=iy>x0!nHC1yu+oTz%G<EkC=(O!ej+*--4V{sO^-+g5BOeJbgV
z!rQo$1`Rib+gKV8tT_}>-8+8`Q}^aw3Tn^vGA=uB>k!(g{f32C>hw{s*RSFq@ZIkb
z40xa8Aok!;^>iWe>pQjPZ0ej6_P{t>-6f((MZl_AYgOr5(W@@XN`JCuGrVnBn!28!
z-F(H8$wqQwMPhYZ1)tdSrMn&R*U)%z@s^bD<*(^cjO|a)yb@VH|M421WB;eQ9MYQB
zlJ@#-VE@ECgQu$M;)jhizG`+J61bUXKfCJj6`tcO^h*}o=c+gc^qgD8;Htto;m6Mt
zbKXeZ3qNb9YM=}cS58qwF&2?0!Y4j$zxa2@oUa0wB4<zTkgDl$G_W*KG~i@o)#hVn
zl450G5m|dHODQ(;a#r?i=AU&FHM1>kM2lDi;(mQUExVunN@vm$*QOnR-9RA<0C*AR
AkpKVy

literal 0
HcmV?d00001

diff --git a/crates/pkcs7/tests/data/rsa-aes.p12 b/crates/pkcs7/tests/data/rsa-aes.p12
new file mode 100644
index 0000000000000000000000000000000000000000..355e781276e1e3094a4760e3d2923611ebff59f8
GIT binary patch
literal 2714
zcmai$X*AS*8^>qH*ta1hG-EAk)ZZ3^?88{IG-S;-RQ6pdGO~@Gh@#t`Y{_24V2HAn
zJ^M2DA+ja(xX<&PdilKgo$GwQ-|L*;yU)1*JVP1;Oa<T>G-&9>A}|sA%wSq@Hl9HS
zif52Gjl}^x^xof!CL0g6JdMmCV9@C>{M&$m+kb$X888MU{vs0~423Zdh=c!0uU`Qj
zS7i9^xA8zAbRd9<hVH+=Lg=YMz<C;a+XxI8M+F6oL17Q;1LuT#90G5vKElAes}mmM
zsb((CRz^ynI5OCe`X*iOtFb=2@Lj#9f0`z-GUT)N>$az6+_v6r112TC*;<*!3h}?h
z+)6UvI$9|<!B6aJ_eWswyxGvHz!wki{e`)ZO@&mJa_7}woV5=&EkHMf-kK-JDLqoS
zdxYxte!UhxM<kn~zwT)W$#R^eu^S898jM-RRn^2u4mbYpkgI`fe9+b9J)=#V<HpYN
zj)q%*oUE^0%&bai&fLN2Y%~+3(48E|>xsD=_UN#Qkeh9Op7spQDW+A6-zy89H+Jqh
z>gmvAoxgoy#`OpCgX>sHz_a4rHH`@8{=i$m_sjEC2KOqS?_Y7~DLpI}MV~u5`=wp$
zr{2^wd*&9*1ewr@xi|la{*Z`_56n%*4nL4L%S(D?&^ZsTF(*%THu(@5oMjff8G5<=
zU~Tfe#-fFd>mPrZe#-0L=0i2QDD$QGPhXdtd^faqa(6!?SWH=9n$;lCY&J=TY_XPc
zxk__HoCji6LeM5n19ms^!wd72AQ59);btOl{Pk)woRV5_GP1kDnNaY}HEis?x}*!!
zwRN$K6cJ0|&}(nou(cc>yqFi%6xOrHD4SwQshJv~*ev8QV3UM*@w#NvWr=yv3$vM&
zw2jgkd(uv@D1$M(b=om72K!kba>mo7&5=0wr^mC>iG#`$<wVGDX7;;RDPPf73@v+S
zdrF!iV+#bLsZ5_Qw`)_A$m?LPO21=;Ce&_9eLlHPey3kU&_BpF$PMC8ZOKv))0>^<
z#KXEzX>hhb*561WZGRgpjV$XxJqhr-3&rT0{pR!K6VDM#COxH63KAfDMiDe6OU3LD
z8cF8c<%<5>7F@;3x-6Y=J9cf?B?J9#WBwPC%ee)l@ynx9L+&3}uwbqG7tlj&)XX7C
zSf_wcCAJBD8bYdvJGeUEFw*FLYrCEH;|>oX9Z|`gFC6IMJ?hw{-}5#7grR{j4x$mf
zeejR$=Np=`?-c>lIUd<%2-zUM4mh{GRjNN%y{v<nXI|}TdZ4k&gEdVa|0Rk1IQ_M(
z3!D16(Ir}NO3EiyBe#xy&ZvwH!I8j+xol|vHL0Lge&?hp=t=2*#SB7IH(=t;m0&<7
z{W(R8h*ml?YI(K!;sg3`?x>-uf?WN=Du~vqE!B-#^4k?p>k+E7$2(frLgyNAR+Imz
zndi8MFTW2x8hEuJRe4l<MA{3AUs4DO3)1AKIQ4GbMp!6b&%3Fm8%WrzO6Ds17_wPf
zHVl{8v{*=Ka<`~<RL-YQymG(qfRk$8rcXI+xct=@<}>XEas0OB$b^=5I>mCY=+2*J
zInu6ffQ$ivr*8P;jekW%T?)lh7oEoWr!Sj^@qdnDVgN%<OVnv7^Z&%ttu@95!;-oY
zXjzTMV?o;gE1rqU3*w&Ze295$z024$su?IA+8;Houj?*y2J=pmT-|tI^voqnC}&(c
zvgWln#xbD&?7&QK{-DTy35P%teJ3cuovYCfDZArwM6@dV88)-&82w4Ca^7z{Ytu58
zJ_Y&y>Q)5i?YkRcY6(l!*>vDmmmKc3r&ZDymkG0q&!wN5Ee02Q2z3eWWEp8y*f?W9
ze7V2-s0}W<yso`q=zY<?wkhik+~{&%Cna!>_(4s5gU38ZOs}A~?i>nfG#B-tbN*&o
zCQrjiUZUo$DMSaQZ))bwRi#nn8Wu}r2PS#V>s5XXpB;3x_EJ82OsHsJiscd$g%2le
zCT&>glgu76MVHE6ehGUX$Aj@0XNg}PW#H<KaQ`eT#~L<nq85;{*WIpuz0=Qs7L)z3
z38{j7^@3CCEgfPo!}shXxn9J}kgjvlHHANvI{JB}JSMJUcMTfv={@GQXuJ;vSvRb4
z%d?u)ZgId8X<|GJZ#i4JIVI2}o75J+C`<P_q;ywliO$_Zr;*;gC_JQM@-845f8!xT
zHrNgZMR?Uhb{tM<WxqjU=>!{A1w2hN>A&k4T9eC#LU035Bi=usi@cMEVz)+KcNG}I
zD!M$2Y*lsLId6rpYR#X@f5IhUpSu3O$kH*imCrv$i@ipb$8xE0q@~rcOSU>g&2wxV
zI+O{}rJ6>nTS_b@47Jt!EUT8_(hss<t7KL!5LRqJi%ZfSD@X#PD`#SYmw4-Bg}~Az
ziyLR~!OI_V6N}Rr0^`2MuPC9Qz1@D<&8<&%tRL*)Bi<e!Dhkv(2(iJ(sN4X2Nn~T#
zs4F(0uzyj8ub^<?fGl^gRzB7IvJ??jvrbgN>3KFNFI&{FN^zwt%Z(}Xm}^%$AG#rm
zojy2VpDt=YqwB&8KLg<7OT?m_K=G(wVQjG9yDA2W^>iM*d#vO{zqs>^10O}>&gv?=
zJD6STJ2=Nk+w<D9_M1AI05h)~K*d}0`*6mQMs?~&r#L6r%4V8<7JfV1`##rit(Gj~
zdYGlKu1D6R(odn?I(HjXwPxd-+Gkgb3Ka2FUEc4uQ-W<M-P>kC{fd-7j<}ezdT5mw
z8<#O*?a~U{4i_)&P73s6`XO1!cFADpDEV2LjM3v+UeD@xy*5tkuHJDDVM!c3G3Shm
zyMrsZaq<g(v@L^P;^tD<^}ZVeyu1M}33V=BjPztK^Ks@C3!UOSYLn|GZge`!w0p`9
zMD>Ld(fg#K@9PtFz7ek5t7_3jsyI^;aoc8B$gFj#;rd8t;_j`^rrf*(-u21eEsn+Z
z6WmYo6J4RgORrS2;y(L)S81lS<j&U8t(Zm$dq}JY7p22TT}}^%6@{;x13ExQh6j(y
zs%9^nT%X-MlgtlFb0{Bv&jDVN6LV2w=*nc{X0@kNpS8d(ar1sAg&8*8M4XV~WMZ_9
z@7yJHxaLb=_X5N(sQN8a1a&Rg3LETaA^ouNr&m?i#jW~ga|!O52U_qaZY4NWY=yMB
zweH5o3#r{;ib<%b&lj~a+lLh=><(j=jN}X3F@@z2Y2V>CobbsdU}=Zg^trr-WjxQ>
zr~TTPdQ0bf@|Mo}tKfWA!5qx|ki0wI713itK`(z(Ky~p`xZnilpNob?m!TsKBd;7#
zhsP~<sAexz9>6-fiCz*n0ii#lrRS93f^y(y?)*kJ3|B3j=(>o8Igl_5ob`bC-z5$S
zemER-6NCf#fP6vxAQRACkTb~rl)X>M_>@%vZ9oEG{&U4az|<fp|0jJfF5B3oq+&E@
uL^$=w1K;B!mCtlRiDziK(gYr%-$G$@)IY^qihHj6*9*iWA^CFu8u~vECG_tA

literal 0
HcmV?d00001

diff --git a/crates/pkcs7/tests/data/rsa-legacy.p12 b/crates/pkcs7/tests/data/rsa-legacy.p12
new file mode 100644
index 0000000000000000000000000000000000000000..32dc28d49e4abb3dce158be607cd20a08ed1a54a
GIT binary patch
literal 2556
zcmY+^cQ_mR8VB%@P_ehP_GoQlwA!euqP1zFNUcVWW5+I9tD&??jZnv|NYz#&W}-$o
zMq3;sW=j>ZYt<gtd7gXkx%ZFX^FH72`#!%vKTs@qpPmi~#e(Y?!E!MMF?(!u7wGb^
z;6e}<OgOLKLa`v}e^!inSP<mA;-#kpoDa5tHgr%SM&^J2z)HsmWd||oKVRO{A1j%s
zr)L60Vu3Sn+I1%#=L*fot#tt{5#0yxsvK98c>Vij8%O=%ZqmD!>{0p|nW=@O*B?I5
z>qh3sQs+NLT1_K{npVY2IE%bD-ve#FvSr&13w^;m>X|O+TWU{7jy)zi8TY#wrLBh(
zo;G{yuv8N?c~I&Z+$Rs$vj7fE&BEPo1{W7!4KdStv*0eF)@yIps3&0vP-T@<S47+D
zLi`t&*VAGuKp-vpNTRC-V18L9q_ru-4RAJ0{T^#yJiXGK+k0Hmu&34hvH}Y@It)P`
z>ALEMs&Yg1;=EU7t|7|g6Pidzq;lr{biL8)(^kJFX12mSzkEfglGJR~z-p&i^%=Sp
zUb$EQdk^$W51_Pmq;53RZ+X}RD4ouY1O?Y=Xw-N~Wm7MEg(TOuxFR1Y^6rW8DksBZ
zQZtN#ES4)`m6c%<Y8h{o)uqThXvpxGYVT&pM$-VuGc)$46LrE&tt4KOl3n|b&(Wmy
zzQ`?$sDyn+trQ+ZsCKo!_zg%{rP{Yub3*C+;vYK^_~JGZrTDN*_?}DBIM!d|t_1^7
zo`&I%+O3tpKG2IsqTWs0{W@b4b84HBv#q(_J*30F&*C_+_z;wndg8+Nlwu3tBNh1{
zzLDDh_RPGLxO#kJCdQWU0%xu+`g6QVx%8h5)`O^!Jr0^i8Q<*6q6Nvjrn=Go;IVUg
z+sL!^6BJ4Mk^iKoMPK@d!B5u*v-GFfd1Xuk4k5!qH#FeU)O~`SdxR%AN3hTDC#D1Y
z13#~js^k55Run_`Dzdw@9!=c0(8r6Xcrr^J_aPgLbMM(q!bo~<$f$vFR`KVdovI2;
z^)lHGDNL?($OP?hQ<^p;R>&J|gt&=II8DZ|;xPDmWGm4e*9#2f3Q`CYmi1Tg&1{5@
z+Fr7J{=_~L2J=HFgnOpJqNSVeJl~GnayZ#;Nf9eF%VEn1`(tKmPBdpwa=x&x_{}v|
zrSIB(a*_h7p`Ms>S%xu6^B4(ET7aQ62v?R*;{KdHHmqyuJsLRZCo&(BP1JlcO-Ux*
zgBo1|o(NUgW!m2DMXF9!;PUscd(sGMqQGW|^`@YzVP}#V*k(_==VD=Y5BD{mls=AH
z@NUhbcojq<R7O)g`W^A(x?UVtP>KNcQ!oVMaq+Oj$ddDV9|9FUm#&K~-&Y%b?xSlm
zkeqrtO)J$2AR>88SjznM=4M5w*{kC(j<YzTY84zPse{%V>ANCDk0qOdO|o7qMP0pn
znT=<mOf3i-1H2%7;z}Z@^CprXSgOy|W9?E`wQ0wpUW0vEW!gR|yZzEA&0X@5d?gCg
ztCHJ?eG0`g`1}tDc~}M%2+Lr9UL()n14fqr@W4z*f9}ZoIUvjbrv~tEHI6p<D8K#g
zG55C`AS|f+0&hXvtnWPHP9hCW5eds#!iv_JaOvLt>5$?OZk0bh5|l`m>e6B|*cP<5
z49GfD!PH$1B!6q>BmA)WC0x*LWDidaDE2IQaW`rUr)H7<NsgQsX7&8p1~w#%CWLwE
z@ETxXBG{7nN9k5G&k%X35RVA@@bLA~<ZCl)+|*yTkyGn#b?q~Y)kViW29L8T$Oc>1
z`Q7gfD$0OUwU?w}jBMNsda;dcLLrwFdyh34hw8puSrO;`z``vx&)?@;&LoHe>$=i0
z{)lMqUTpkSlW`!U^RswL#?Gxt6gYm<Rii}^byv8(%orqiW#Ws)ZFS?(dZ41JNu;&^
ziW2|qS&jd(ddXRG0<b^gw-b4$4&L=Q^W*pHTMAQV#l|K)7&mvO&wv`fNYci>0uets
z_fX-e&HU8RV^Qm>Fs2AFPlPVKzw)+h(z?^3z2(u5+?#iI9<+<{6X~j1G4~ieO#ifW
z+%XI}ktWT#4JSDa3KRw0%4HjJwP~Lv^x6!1e_fmD;P1|}D*3wIpBC@Kv{v*&yU*x%
zl`1=bJZOOs=tg8w3<?y8{z{f#X*TpZIBeV{i_>3MHXpUtW^=@p77jH6Tv9TZUNB<=
zam>|;#Y!RjGD+c<vR=EvES0R1g0ZON)g0>K;l%B{<sbZ9Ms4>y4zE;YI;B)2nt<EA
zG3eR|#i^KAgtg<!`!h#Yo6xcZRg#WeqWq+!+5E7aj|qF5MvvKETB659YP80a;D8mM
zK#pI^hC%V)G|u*x`>cdd-M~^ZBka9zUp?T)Z@RK|N1zh=D)bGu-j)??>ni39mlTz5
ztUnVRZE$e16QMYk=TW|{hP1^(rhm;&={?am&?itCGJFkpTps4G*d-ka(Q;&$Tce}A
zpWQpC=T4yo+${3sb_{^{_ur-zna?$_7DnMDe7a0J_U7T?crz=Dkl@dCV(2FsCD3Z3
zkj~F~%;1(_hM{DwC6hC~J8mwKR&N2a8Tr&$v?#%775laTKiTN~=<4N-dmH^^l@XzO
zu#y(R5Q+RwOO62ee_k2P7fhvjd3iOx2)<lDN#c=m8$#r(z+sa;3vatA<Erk^TOoI9
zPL={e;pOiLpN7_+I2FWDk0Y`^)-;z5JI;LQjZR*J2_(h6A3Ncqt8?z(x}O)KiS7#|
zli~B@rMp(&#7hn+K@jW@JDA~oD{5tgBNUK0l0N2<KO<8d+}}z5ZhQ?kg0u!nG)D@D
z&k%<T(V*nN_8Xcju4^I~%B96^J1*7Fvc6y^W@3RnflZbY7kA8<A!9;J+pyJltH(l&
z-5%FQL+qZ`i}EKO#%(jXN80Piw0KhTSResfe{K7!PG=V-(JiK3)!7o#31;o_P(JRw
zD-^}Hl(YhV#^K}9Iz0B<=M^bWB^R>#rlBoQgiN>kg!|M`ezEIFLPJEc#s&_qb&Fn=
z`kIkb-`-*33}I?=q0QF$PPFk;-6|_sSm`Zk-=W$j&f5p<xbQIwphDh(*rfWQHGuQh
z%W<7@;TSY-w(=uw%k)B8zlb4o@y}yorjE5}daaj}S8*KkjTjO-!smqE3vHvVySbsC
zHb*|D33L>AC0;l#s}fdlQ8RjiRpxWV*~nK=MSSlV#xJN?LM8vJBbZNxAH?fC<9en*
zqSnlv8hgk@p*sxb_!^*!{~YnEh>3^*ECJ2{e?S0041fT*0bBr>^Xzw?;OAKfdIKsB
z1v4_pvjgcbF#tfk>NkiGuI;N?93gt^@2l{2#MNF1h*Q&Yq_M*36^(;eOEIZUck*vs
F{{<e-(Gvgw

literal 0
HcmV?d00001

diff --git a/crates/pkcs7/tests/data/rsa.crt.pem b/crates/pkcs7/tests/data/rsa.crt.pem
new file mode 100644
index 000000000..d4db60a15
--- /dev/null
+++ b/crates/pkcs7/tests/data/rsa.crt.pem
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDUzCCAjugAwIBAgICA+kwDQYJKoZIhvcNAQELBQAwQjEYMBYGA1UEAwwPVGVz
+dCBTaWduZXIgUlNBMRkwFwYDVQQKDBBQcmludENyYWZ0IFRlc3RzMQswCQYDVQQG
+EwJVUzAeFw0yNjEwMDIwNjE3MzRaFw0zNjA5MjkwNjE3MzRaMEIxGDAWBgNVBAMM
+D1Rlc3QgU2lnbmVyIFJTQTEZMBcGA1UECgwQUHJpbnRDcmFmdCBUZXN0czELMAkG
+A1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDL4UlgowrY
+WL1zAdrL1hQ38oFd/flQYncADv5AK45helQhv9zwGTIbuAuGJPtydzeUvKgY3Rdl
+WLJFJeaudoN1iJ6ilR2i0gLBEYF2QhCqebgHkNE5up1wCKmV3KZMTWJZ0eKlL+ae
+kSOOVmAowXHX5iWo8fv2EdIN2VYqrJe0UBu4HkRFybxesQrcx7d6CQrzlyS0WZns
+LGAJARyOGofztI6zFly7JwdeqBtZ0PIz/XeLwII6wf2Sd2IwO2KsJ5X3HarN80M9
+BxASkaSDkUMoLsB1Z6fKrPwGYX5BUKVMXj5b6b4cq5Cd0a7kT8YMuCQJrLIiSorY
+i7pvLAlfiC2hAgMBAAGjUzBRMB0GA1UdDgQWBBRZCY3Rc9d2HvE5zJUEt9yi19b5
+nzAfBgNVHSMEGDAWgBRZCY3Rc9d2HvE5zJUEt9yi19b5nzAPBgNVHRMBAf8EBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCbH/lGas10CJTyIXuyA+m12nkqIpVVvd8W
+s7Mw+wa3J3sGcBUKvMdeMl753Yclyow6w3FO8a7o2Ra1qG0YzU4ml7WKOlCMHFgl
+n9Idwj8xsqbNIpkZ6gNCluABY/NcxZEv6XxfxC0b1cKbbIXybnYgu1xiogZ4Oy9E
+0ySTcjSGFo17TBkUwsBDz2erTeMzhkU0UKBxt6EGWdR6uFJOw6SKf1HjiGxW1jJD
+fi6jC3CmChnV6xOuhWu661QDhYBRLV2r2EDmNiKwaDq0ELS1kSIMEwMTorHHGR0X
+1d+swWSwo2DPABkXh1WJ54usCpgSqDYnbJf5clzhz7ZThhPO/kJC
+-----END CERTIFICATE-----
diff --git a/crates/pkcs7/tests/it/algorithms.rs b/crates/pkcs7/tests/it/algorithms.rs
new file mode 100644
index 000000000..541e4a373
--- /dev/null
+++ b/crates/pkcs7/tests/it/algorithms.rs
@@ -0,0 +1,140 @@
+//! Signatures by OpenSSL 3.6 with the algorithms beyond SHA-2/RSA/NIST-curve ECDSA: SHA-3,
+//! SHA-512/256, RIPEMD-160, RSA-PSS with other MGF1 hashes and salt lengths, Ed25519 and
+//! brainpoolP512r1. Every vector signs the message "hello" with a throw-away key (see
+//! tests/data/README.md for the commands). The CMS files are detached, `openssl cms -sign -binary`.
+
+use craft_pkcs7::cms::SignedData;
+use craft_pkcs7::keys::{DigestAlg, PssParams, Scheme};
+
+fn unhex(s: &str) -> Vec<u8> {
+    (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
+}
+
+const C_RSA_SHA3_256: &str = "308205e906092a864886f70d010702a08205da308205d6020101310d300b0609608648016503040208300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182025830820254020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040208a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d010904312204203338be694f50c5f338814986cdf0686453a888b84f424d792af4b9202398f392307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300d06092a864886f70d01010105000482010004884153af307d5b12f87d673598b15b1c722ed15091d97af4d36e40942b009f849b55e4429ee550ad7f001db9a1cb293c2319b253a1d998266897f27c35e9670c87080a71e932beb932d594c4f9735e5dd20d3145db26c4352a1ebea7c7692e3272032e1a1736445eb238b93825315369beed81839f71525848fb8a725b9804cc2ac6c8756754f46fc182df5a1bf0dbc97bcf8a5dbc0d4d9da26f7b68029d1e7fc35893958d6c7084f3199605e103788e2a61cd8a68847588d8607a1a31cb1106753d35109cdd309a098553dfd0f33c2269fd5b396318f35e06c4d67be6a7b05dbacd2c265a3bbfa11c1a4c192052e4130aac97addb703514d43e62dc8b629b";
+const C_RSA_SHA512_256: &str = "308205e906092a864886f70d010702a08205da308205d6020101310d300b0609608648016503040206300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182025830820254020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040206a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d01090431220420e30d87cfa2a75db545eac4d61baf970366a8357c7f72fa95b52d0accb698f13a307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300d06092a864886f70d010101050004820100293b265b6bf4eaa2d3b3777c6116fd922696578bd835f77728809758d7af89aa96afab9da9e320183c63ead9e499508d1f892aea5e1e5b96645b838062f4b14062fa417bdd23257021c05de0e9614ed8141715e9354f21f2ab389194a447c80dda6c87ea80d551abbb0cfc450663359c747cdc41aa296f1a71f4e2b53e97c94d30aa094edbd0fefe53835e550a1a9c55404f8f41d32cc8033df7e0b877008ac6f75f02a6071b02647e5adf756a56f683f452d5f9a180fa62f7c7089019b99037b8e3488798238b85ae5b773b4dfd0d157afe4688209520244bd77a56dd98bda615b2e00312a1a5595c439e84af24749e6d6e44abd7da2794523faba3d0acb737";
+const C_RSA_RIPEMD160: &str = "308205d906092a864886f70d010702a08205ca308205c6020101310b300906052b240302010500300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182024a30820246020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300906052b240302010500a081d8301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302306092a864886f70d01090431160414108f07b8382412612c048d07d13f814118445acd307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300d06092a864886f70d0101010500048201007373c1c0747a77c073a62cf99b97ac43c15677c668ebd6c965296ec1a8c30f33e5b4cb35c652db0c0fe3184259bae01d6f7df64026ee4b58ac5005c46cbf603e45524fba7bb54e81cf0b10a5e7843dcbb8a72d60ffa9a503d0bc5c2306374688b95ff7f4d31366385a69fee1f6c657bd3a82418c56afc53b30446ef0f5776e17769761f1812379c83835f17614f1b2e9adf2ad5cc645cd861cd1e6cf2ebe14a963f208655769e1d6139b4bdeaecc366b0e3924ec46fcfdef05979674fdfb33ada6a0f185abd36c6cd3ff3ba6684b99a72154d933ffc90e8950d72066bf5e3524c09632ebdac06c2944084573c2a6e5344c6a09643f832441a93ef7dc39affd45";
+const C_PSS_SHA256_MGF1SHA1_SALT20: &str = "308205fa06092a864886f70d010702a08205eb308205e7020101310d300b0609608648016503040201300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182026930820265020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040201a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d010904312204202cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128301e06092a864886f70d01010a3011a00f300d0609608648016503040201050004820100159800c2d48396d32cb1e3dddf841f0bad186da462fc45cab82bf6d2d4bb8f82d200560b16f2ecfea672af07af82ae967453193e130071033d47bba03a7d81685b29812293a6d33f4126103ebcd4552ced5c8d13ea6fcac5920b5ab0641b1884919cbed2cb280cdc19569094e0ecf8fdebe0b53a546f46cdb2c3c41b030e520302dae89d9d10206c78ad0fd2ead13dba8b067abf185de957ba4daaa8de7437ca014567d7cfbe8d0f6f9cb8de8dceae5d7292ed731170323e0def553653d4af11239d52eacf1f1a406e6d8c1d7f597af25a2154582d1ad2e9c3b8951ba1350ee3322ef76ac988829de28917c7b153fb493913195250e95185ecac4081e6f18355";
+const C_PSS_SHA384_MGF1SHA256_SALT0: &str = "3082062d06092a864886f70d010702a082061e3082061a020101310d300b0609608648016503040202300b06092a864886f70d010701a0820357308203533082023ba003020102020203e9300d06092a864886f70d01010b050030423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553301e170d3236313030323036313733345a170d3336303932393036313733345a30423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b300906035504061302555330820122300d06092a864886f70d01010105000382010f003082010a0282010100cbe14960a30ad858bd7301dacbd61437f2815dfdf9506277000efe402b8e617a5421bfdcf019321bb80b8624fb72773794bca818dd176558b24525e6ae768375889ea2951da2d202c11181764210aa79b80790d139ba9d7008a995dca64c4d6259d1e2a52fe69e91238e566028c171d7e625a8f1fbf611d20dd9562aac97b4501bb81e4445c9bc5eb10adcc7b77a090af39724b45999ec2c6009011c8e1a87f3b48eb3165cbb27075ea81b59d0f233fd778bc0823ac1fd927762303b62ac2795f71daacdf3433d07101291a4839143282ec07567a7caacfc06617e4150a54c5e3e5be9be1cab909dd1aee44fc60cb82409acb2224a8ad88bba6f2c095f882da10203010001a3533051301d0603551d0e0416041459098dd173d7761ef139cc9504b7dca2d7d6f99f301f0603551d2304183016801459098dd173d7761ef139cc9504b7dca2d7d6f99f300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101009b1ff9466acd740894f2217bb203e9b5da792a229555bddf16b3b330fb06b7277b0670150abcc75e325ef9dd8725ca8c3ac3714ef1aee8d916b5a86d18cd4e2697b58a3a508c1c58259fd21dc23f31b2a6cd229919ea034296e00163f35cc5912fe97c5fc42d1bd5c29b6c85f26e7620bb5c62a206783b2f44d32493723486168d7b4c1914c2c043cf67ab4de33386453450a071b7a10659d47ab8524ec3a48a7f51e3886c56d632437e2ea30b70a60a19d5eb13ae856bbaeb54038580512d5dabd840e63622b0683ab410b4b591220c130313a2b1c7191d17d5dfacc164b0a360cf001917875589e78bac0a9812a836276c97f9725ce1cfb6538613cefe42423182029c30820298020101304830423118301606035504030c0f54657374205369676e65722052534131193017060355040a0c105072696e744372616674205465737473310b3009060355040613025553020203e9300b0609608648016503040202a081f4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a303f06092a864886f70d0109043132043059e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128304106092a864886f70d01010a3034a00f300d06096086480165030402020500a11c301a06092a864886f70d010108300d06096086480165030402010500a203020100048201003ce51d5b4168c11bb39613de1c2633c8daa86622bdacc1313cf6d597bfb9c15311dbdde51b0f0d3ff67dd922e13e79b84a414c8c9cfffbe35bcf83eefb32b7c5cc371dc56af704cf5b3269dca13c48f27d64a06bc98710f1e3f254b23ba7b41e7ec7027087dea4f4fbb9119d86926220f93d7e8d7be9ad3c5c41e3a4e1d94f09a9f494aac93e13429eec6358d77d83b937686fd41beaeb4d551c3a48ac743ba27592a5435aa8add806200ea3ec61712b8ba4580f2bf80c488b3bc5020c13ecac37a68e3ad3895379a788dbd8a080ed19178dcdaf35d0d8a45d1c7c81e4ddc6916eb74266bba6c3b616b421f78ceeddda3331f3148b6e6145f5b2c4eca9e35b41";
+const C_ED25519: &str = "3082032c06092a864886f70d010702a082031d30820319020101310d300b0609608648016503040203300b06092a864886f70d010701a08201553082015130820103a003020102021447398d434ffa904166d2a7d30fe4df35890dab29300506032b6570301e311c301a06035504030c1354657374205369676e65722045643235353139301e170d3236313030373130303735365a170d3336313030343130303735365a301e311c301a06035504030c1354657374205369676e65722045643235353139302a300506032b657003210007233d4f6ee95134d0232c25b1b5bef159b0c0c32c8911773fa68e99bfee67c2a3533051301d0603551d0e04160414e5fdf0f2f76d4aa4f9cb70dc9c3d6066aa6efb23301f0603551d23041830168014e5fdf0f2f76d4aa4f9cb70dc9c3d6066aa6efb23300f0603551d130101ff040530030101ff300506032b657003410085df55271628b581a5b5c6531253eeca4a3aea556007bfc3cb15132b3ddfc117c5c632a150a025cde2a509346e0497411169812dea45b22257c5d50eaf8c2a0c3182019d308201990201013036301e311c301a06035504030c1354657374205369676e65722045643235353139021447398d434ffa904166d2a7d30fe4df35890dab29300b0609608648016503040203a0820104301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303833395a304f06092a864886f70d010904314204409b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300506032b65700440e3924e19b88b24d8b614a29cee8c3190c9b0a753273705b794bc2e37ca1e5b1d567ea724e5c4a4189ad102ea51d0506e645aed78ed1835e94eb1543cc9a57c06";
+const C_BP512_SHA512: &str = "3082043a06092a864886f70d010702a082042b30820427020101310d300b0609608648016503040203300b06092a864886f70d010701a08202173082021330820176a003020102021417327c0f542434a70893e2caaf25132f86d924a8300a06082a8648ce3d040304301c311a301806035504030c1154657374205369676e6572204250353132301e170d3236313030373130303735365a170d3336313030343130303735365a301c311a301806035504030c1154657374205369676e657220425035313230819b301406072a8648ce3d020106092b240303020801010d03818200042bcc6a56c9e35aff784fb796021f73923d0d8fafe4573df9a3a834f04dabd67fcaaa23c2a20d15a95d42db3ffcb9e9bc5a09cc0d052afdb830e01600782e1c2a307d843f1d804a2083891608b5f05e34273fb00fca1f8a0ef82a821bbac7194ff34c2ab09f6efa4fab871d8150a0fd1625990bd04afcdee025eb585fbb2178c2a3533051301d0603551d0e041604149e51d60b2b4c8459d59e41a99d57a79503b5362d301f0603551d230418301680149e51d60b2b4c8459d59e41a99d57a79503b5362d300f0603551d130101ff040530030101ff300a06082a8648ce3d04030403818a003081860241008126d9a4de09333ad8db822c0718d7a1d1c3a41fdc2f8d5f551109092bd24b8d60c305885a1aa91faf3d82208efa5e92ad0fd16e145dca5da3e8ef026242e1eb0241009b124b54fbc4793a50cc6bd9af3e2d0f459943a71999d9175522ff9668844cce4600ffddbef2a2ca4f49c0c3389d37c6ceed14dea1c3c7320e76ffff327ffd1c318201e9308201e50201013034301c311a301806035504030c1154657374205369676e6572204250353132021417327c0f542434a70893e2caaf25132f86d924a8300b0609608648016503040203a0820104301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a304f06092a864886f70d010904314204409b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300a06082a8648ce3d040304048188308185024066a840051f4caad67c7df0d7db8454f3dbe9184ead3287447c9a5f62eaaaf0cc538979d228b8943d0abd103ac9d5c2ea6aa64384ffe284ce0233dc13b25f6594024100900d2f6251b75aa6224228d076870d014824f79c9670c6d83e8772105c0668c1d96f617c9b09057da442df5aae0dca9dc127cd0ce3de7bfe165270b018143fd6";
+const C_BP512_SHA3_256: &str = "3082041a06092a864886f70d010702a082040b30820407020101310d300b0609608648016503040208300b06092a864886f70d010701a08202173082021330820176a003020102021417327c0f542434a70893e2caaf25132f86d924a8300a06082a8648ce3d040304301c311a301806035504030c1154657374205369676e6572204250353132301e170d3236313030373130303735365a170d3336313030343130303735365a301c311a301806035504030c1154657374205369676e657220425035313230819b301406072a8648ce3d020106092b240303020801010d03818200042bcc6a56c9e35aff784fb796021f73923d0d8fafe4573df9a3a834f04dabd67fcaaa23c2a20d15a95d42db3ffcb9e9bc5a09cc0d052afdb830e01600782e1c2a307d843f1d804a2083891608b5f05e34273fb00fca1f8a0ef82a821bbac7194ff34c2ab09f6efa4fab871d8150a0fd1625990bd04afcdee025eb585fbb2178c2a3533051301d0603551d0e041604149e51d60b2b4c8459d59e41a99d57a79503b5362d301f0603551d230418301680149e51d60b2b4c8459d59e41a99d57a79503b5362d300f0603551d130101ff040530030101ff300a06082a8648ce3d04030403818a003081860241008126d9a4de09333ad8db822c0718d7a1d1c3a41fdc2f8d5f551109092bd24b8d60c305885a1aa91faf3d82208efa5e92ad0fd16e145dca5da3e8ef026242e1eb0241009b124b54fbc4793a50cc6bd9af3e2d0f459943a71999d9175522ff9668844cce4600ffddbef2a2ca4f49c0c3389d37c6ceed14dea1c3c7320e76ffff327ffd1c318201c9308201c50201013034301c311a301806035504030c1154657374205369676e6572204250353132021417327c0f542434a70893e2caaf25132f86d924a8300b0609608648016503040208a081e4301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3236313030373130303831315a302f06092a864886f70d010904312204203338be694f50c5f338814986cdf0686453a888b84f424d792af4b9202398f392307906092a864886f70d01090f316c306a300b060960864801650304012a300b0609608648016503040116300b0609608648016503040102300a06082a864886f70d0307300e06082a864886f70d030202020080300d06082a864886f70d0302020140300706052b0e030207300d06082a864886f70d0302020128300b060960864801650304030a04818830818502410097943cf78c3e6440f03e00d7ca3a96d986190e7cc56db1b1d3dd806810c9d731d5ab576df900173082372fd1beeb206da3bf1958c11c375f5a38aa2766f083a402402c495a25cc16836322d724606b34912ed08904c97e2c1557ca13796ce02ad37d4a2bd8ce0001f020fb131c3c4e7602c8346e30b0a23a5f030d6885aa07a90c40";
+const PSS_SHA3_256: &str = "be8d2369801beaea9c45935787bd005a6d6085003cb235c5bf8c867cafd8edf9ed288aa3a16b019d64b0668be302a5ca6fa0388774a85471804154f9411fd0abd6738b6fb5a7acf38b60fe70d65e1f93447f57e34fdb502c741001c184113117cd3b7daec1614ebdd152f071117bb1012587f93df00321cc22d1ac53788e1c9906c2c5a31f9364220c1b1e913b2ac3409aca39296a51b4fbc192a87d671dc83726831fa2e59ce1783c09fee8c95d53d8caf50da32d896839a03ab4ff4a390a6dee006dfa686c60368bfc2d64e5d974acb3c022edb1a9fd57a167ce03a31de8eef3a9a7d9460013d636dab53b00ed6e24bf736cdfd56c2be7e8b8aeaeabf74842";
+const PSS_SHA512_256: &str = "4aeff996324c1aae8216497d7be896d949361f80ae5cfeee82a959f9a8ff7c8d2e0ec783b435f1952dc768ea97a949acca1783210e8754a71c9c2255689d370a349dfb9845e69595d3386ee88aafd2369ecdbba53de692eacc68fd5f0e3e2451f6fe000d680d860d235958f666eddfb4dba69ed730b6f9f82889617e744c0ec4fda72fb9e8f32190913dc77bb281713c5f45a7bd9c346645b401fb4a58348d4eb86511bcdeeca113cb9a9c8c4b587da763ce16b104580dee0ccbbac4a3e969ea53835a8067bdd9b1f8109940fb61abb8b03381b5272c2bbc381a50961130fb3a7c4fe02689111ac76f3a4c1f4439d25326aeec75afc3839478b3289a2ff2482d";
+
+/// A CMS signature must verify, name the digest it should, and fail if the signature is damaged.
+fn check_cms(name: &str, hex: &str, digest: DigestAlg, scheme: impl Fn(Scheme) -> bool) {
+    let sd = SignedData::parse(&unhex(hex)).unwrap_or_else(|e| panic!("{name}: {e}"));
+    let s = &sd.signer;
+    assert_eq!(s.digest, digest, "{name}");
+    assert!(scheme(s.scheme), "{name}: {:?}", s.scheme);
+    let content = digest.digest(&[b"hello"]);
+    assert_eq!(s.message_digest.as_deref(), Some(&content[..]), "{name}: the message digest attribute is our digest of the content");
+    let cert = sd.signer_certificate().unwrap_or_else(|| panic!("{name}: signer certificate"));
+    assert!(sd.verify_signature(cert, &content).unwrap_or_else(|e| panic!("{name}: {e}")), "{name}");
+    let mut bad = sd.clone();
+    let mid = bad.signer.signature.len() / 2;
+    bad.signer.signature[mid] ^= 0x10;
+    assert!(!bad.verify_signature(cert, &content).unwrap_or(false), "{name}: damaged signature");
+}
+
+#[test]
+fn rsa_with_sha3_sha512_256_and_ripemd160() {
+    check_cms("sha3-256", C_RSA_SHA3_256, DigestAlg::Sha3_256, |s| s == Scheme::RsaPkcs1);
+    check_cms("sha512/256", C_RSA_SHA512_256, DigestAlg::Sha512_256, |s| s == Scheme::RsaPkcs1);
+    check_cms("ripemd160", C_RSA_RIPEMD160, DigestAlg::Ripemd160, |s| s == Scheme::RsaPkcs1);
+}
+
+#[test]
+fn only_weak_digests_leave_a_note_when_a_signature_validates() {
+    let notes_of = |hex: &str| {
+        let sd = SignedData::parse(&unhex(hex)).unwrap();
+        let cert = sd.signer_certificate().unwrap();
+        let mut notes = Vec::new();
+        assert!(sd.verify_signature_noting(cert, &sd.signer.digest.digest(&[b"hello"]), &mut notes).unwrap());
+        notes
+    };
+    // RIPEMD-160 is named; SHA3-256 and SHA-512/256 are not.
+    let weak = notes_of(C_RSA_RIPEMD160);
+    assert_eq!(weak, [DigestAlg::Ripemd160.weakness().unwrap()], "{weak:?}");
+    assert!(notes_of(C_RSA_SHA3_256).is_empty());
+    assert!(notes_of(C_RSA_SHA512_256).is_empty());
+}
+
+#[test]
+fn rsa_pss_with_its_declared_parameters() {
+    check_cms("pss sha256 mgf1-sha1 salt 20", C_PSS_SHA256_MGF1SHA1_SALT20, DigestAlg::Sha256, |s| {
+        s == Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha1, salt_len: Some(20) })
+    });
+    check_cms("pss sha384 mgf1-sha256 salt 0", C_PSS_SHA384_MGF1SHA256_SALT0, DigestAlg::Sha384, |s| {
+        s == Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len: Some(0) })
+    });
+    // PSS over SHA-3 and SHA-512/256 digests, MGF1 with the same hash.
+    let id = craft_pkcs7::pkcs12::open(&std::fs::read(format!("{}/tests/data/rsa-aes.p12", env!("CARGO_MANIFEST_DIR"))).unwrap(), "test").unwrap();
+    let key = &id.certificate.public_key;
+    for (name, alg, salt, sig) in [("sha3-256", DigestAlg::Sha3_256, 32, PSS_SHA3_256), ("sha512/256", DigestAlg::Sha512_256, 0, PSS_SHA512_256)] {
+        let digest = alg.digest(&[b"hello"]);
+        let pss = Scheme::RsaPss(PssParams { mgf: alg, salt_len: Some(salt) });
+        assert!(key.verify(pss, alg, &digest, &unhex(sig)).unwrap(), "{name}");
+        assert!(!key.verify(pss, alg, &alg.digest(&[b"hellp"]), &unhex(sig)).unwrap(), "{name}: other message");
+        let wrong_mgf = Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha1, salt_len: Some(salt) });
+        assert!(!key.verify(wrong_mgf, alg, &digest, &unhex(sig)).unwrap(), "{name}: the MGF1 hash matters");
+    }
+}
+
+#[test]
+fn ed25519_signs_the_signed_attributes_themselves() {
+    check_cms("ed25519", C_ED25519, DigestAlg::Sha512, |s| s == Scheme::Ed25519);
+    let sd = SignedData::parse(&unhex(C_ED25519)).unwrap();
+    let cert = sd.signer_certificate().unwrap();
+    assert_eq!(cert.public_key.describe(), "Ed25519");
+    assert!(cert.is_self_signed(), "the certificate's own Ed25519 signature checks");
+    // A digest can't be verified with Ed25519: it signs the message.
+    let r = cert.public_key.verify(Scheme::Ed25519, DigestAlg::Sha512, &[0; 64], &sd.signer.signature);
+    assert!(matches!(r, Err(craft_pkcs7::Error::Unsupported(_))));
+}
+
+#[test]
+fn ecdsa_on_brainpool_p512r1() {
+    check_cms("bp512 sha512", C_BP512_SHA512, DigestAlg::Sha512, |s| s == Scheme::Ecdsa);
+    check_cms("bp512 sha3-256", C_BP512_SHA3_256, DigestAlg::Sha3_256, |s| s == Scheme::Ecdsa);
+    let sd = SignedData::parse(&unhex(C_BP512_SHA512)).unwrap();
+    let cert = sd.signer_certificate().unwrap();
+    assert_eq!(cert.public_key.describe(), "ECDSA brainpoolP512r1");
+    assert!(cert.is_self_signed(), "certificate signed with ecdsa-with-SHA512 on brainpoolP512r1");
+    let spki = cert.public_key.spki();
+    let back = craft_pkcs7::PublicKey::from_spki(&craft_pkcs7::der::Tlv::parse_all(&spki).unwrap()).unwrap();
+    assert_eq!(back, cert.public_key, "re-encodes the SubjectPublicKeyInfo");
+}
+
+/// `a + b` for big-endian numbers of equal width, or `None` if it does not fit.
+fn add_be(a: &[u8], b: &[u8]) -> Option<Vec<u8>> {
+    let mut out = vec![0u8; a.len()];
+    let mut carry = 0u16;
+    for i in (0..a.len()).rev() {
+        let sum = u16::from(a[i]) + u16::from(b[i]) + carry;
+        out[i] = sum as u8;
+        carry = sum >> 8;
+    }
+    (carry == 0).then_some(out)
+}
+
+#[test]
+fn brainpool_p512r1_keys_must_have_coordinates_reduced_modulo_p() {
+    use craft_pkcs7::PublicKey;
+    const P: &str =
+        "aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3";
+    let sd = SignedData::parse(&unhex(C_BP512_SHA512)).unwrap();
+    let cert = sd.signer_certificate().unwrap();
+    let content = DigestAlg::Sha512.digest(&[b"hello"]);
+    assert!(sd.verify_signature(cert, &content).unwrap(), "the key as written verifies");
+    let PublicKey::BrainpoolP512(point) = &cert.public_key else { panic!("a brainpoolP512r1 key") };
+    let (x, y) = (&point[1..65], &point[65..]);
+    let p = unhex(P);
+    // The same point written with x + p (or y + p): congruent, but not the canonical encoding.
+    for (what, x, y) in [("x + p", add_be(x, &p).unwrap(), y.to_vec()), ("y + p", x.to_vec(), add_be(y, &p).unwrap())] {
+        let mut forged = cert.clone();
+        forged.public_key = PublicKey::BrainpoolP512([&[4u8][..], &x, &y].concat());
+        let r = sd.verify_signature(&forged, &content);
+        assert!(matches!(r, Err(craft_pkcs7::Error::Malformed(_))), "{what}: {r:?}");
+    }
+}
diff --git a/crates/pkcs7/tests/it/ber.rs b/crates/pkcs7/tests/it/ber.rs
new file mode 100644
index 000000000..8e7895660
--- /dev/null
+++ b/crates/pkcs7/tests/it/ber.rs
@@ -0,0 +1,76 @@
+//! CMS read as BER: the bounds on what a crafted /Contents can make the reader do.
+//!
+//! The BER reader itself is `der::Tlv::parse_ber`; these tests go through `SignedData::parse`,
+//! the way a PDF's signature reaches it.
+
+use craft_pkcs7::cms::SignedData;
+use craft_pkcs7::der::{self, tag};
+
+/// `levels` constructed OCTET STRINGs inside one another, each with a definite length, around one
+/// empty primitive OCTET STRING. Built from the inside out in linear time.
+fn nested_octet_strings(levels: usize) -> Vec<u8> {
+    let header = |len: usize| -> Vec<u8> {
+        let mut h = vec![tag::OCTET_STRING_SEGMENTS];
+        if len < 0x80 {
+            h.push(len as u8);
+        } else {
+            let be: Vec<u8> = len.to_be_bytes().into_iter().skip_while(|b| *b == 0).collect();
+            h.push(0x80 | be.len() as u8);
+            h.extend(be);
+        }
+        h
+    };
+    // The content length of each level, the innermost (the empty `04 00`, 2 bytes) first.
+    let mut inner = vec![2usize];
+    for _ in 0..levels {
+        let last = inner.last().copied().unwrap_or(2);
+        inner.push(last + header(last).len());
+    }
+    let mut out = Vec::new();
+    for len in inner.iter().rev().skip(1) {
+        out.extend(header(*len));
+    }
+    out.extend([tag::OCTET_STRING, 0x00]);
+    out
+}
+
+/// A ContentInfo holding SignedData whose encapsulated content is `econtent`. It has no
+/// SignerInfo, so parsing always ends in an error: what matters is where.
+fn cms_with_econtent(econtent: &[u8]) -> Vec<u8> {
+    let encap = der::seq(&[&der::oid("1.2.840.113549.1.7.1"), &der::explicit(0, econtent)]);
+    let signed_data = der::seq(&[&der::int(1), &der::tlv(tag::SET, &[]), &encap]);
+    der::seq(&[&der::oid("1.2.840.113549.1.7.2"), &der::explicit(0, &signed_data)])
+}
+
+fn error_of(cms: &[u8]) -> String {
+    SignedData::parse(cms).err().map(|e| e.to_string()).unwrap_or_default()
+}
+
+#[test]
+fn deeply_nested_segmented_content_is_an_error_not_a_stack_overflow() {
+    // Definite lengths nest without any end-of-contents scan to bound them, so a /Contents of a few
+    // hundred KB can hold 100 000 levels. It used to be able to overflow the stack and abort.
+    let deep = cms_with_econtent(&nested_octet_strings(100_000));
+    assert!(deep.len() < 1 << 20, "a plausible /Contents");
+    let why = error_of(&deep);
+    assert!(why.contains("nested too deeply"), "{why}");
+    // A few segments, as a BER signer writes them, are read: the error is the missing SignerInfo.
+    let shallow = error_of(&cms_with_econtent(&nested_octet_strings(2)));
+    assert!(shallow.contains("signerInfos"), "{shallow}");
+}
+
+#[test]
+fn indefinite_length_nesting_bombs_are_refused() {
+    // 10 000 indefinite-length SEQUENCEs: every level would have to be walked to find its end.
+    let bomb: Vec<u8> = std::iter::repeat_n([tag::SEQUENCE, 0x80], 10_000).flatten().collect();
+    assert!(SignedData::parse(&bomb).is_err());
+    let in_content = cms_with_econtent(&bomb);
+    assert!(SignedData::parse(&in_content).is_err());
+}
+
+#[test]
+fn a_truncated_indefinite_length_cms_is_an_error() {
+    // The end-of-contents octets are missing, as in a /Contents cut short.
+    let cut = [0x30, 0x80, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x07, 0x02];
+    assert!(SignedData::parse(&cut).is_err());
+}
diff --git a/crates/pkcs7/tests/it/chain.rs b/crates/pkcs7/tests/it/chain.rs
new file mode 100644
index 000000000..004f6d9e5
--- /dev/null
+++ b/crates/pkcs7/tests/it/chain.rs
@@ -0,0 +1,312 @@
+//! Chain building: which certificates may vouch for which (RFC 5280 §6.1, the parts that matter
+//! for trust). Certificates are issued in-process with chosen extensions, so every refusal is
+//! tested on its own.
+
+use craft_pkcs7::PrivateKey;
+use craft_pkcs7::der::{self, Time, tag};
+use craft_pkcs7::x509::{Certificate, Name, RefusedWhy, SigningProblem, build_chain, build_chain_noted};
+
+fn time(year: u32) -> Time {
+    Time { year, month: 6, day: 1, hour: 12, minute: 0, second: 0 }
+}
+
+fn ext(oid: &str, value: &[u8]) -> Vec<u8> {
+    der::seq(&[&der::oid(oid), &der::boolean(true), &der::octets(value)])
+}
+
+/// basicConstraints: `cA` (omitted when false, as DER does) and an optional `pathLenConstraint`.
+fn basic_constraints(ca: bool, path_len: Option<u64>) -> Vec<u8> {
+    let mut parts: Vec<Vec<u8>> = Vec::new();
+    if ca {
+        parts.push(der::boolean(true));
+    }
+    if let Some(n) = path_len {
+        parts.push(der::int(n));
+    }
+    let refs: Vec<&[u8]> = parts.iter().map(Vec::as_slice).collect();
+    ext("2.5.29.19", &der::seq(&refs))
+}
+
+const DIGITAL_SIGNATURE: u8 = 0x80;
+const KEY_CERT_SIGN: u8 = 0x04;
+
+fn key_usage(bits: u8) -> Vec<u8> {
+    ext("2.5.29.15", &der::tlv(tag::BIT_STRING, &[1, bits]))
+}
+
+struct Party {
+    name: Name,
+    key: PrivateKey,
+    cert: Certificate,
+}
+
+/// A certificate for a fresh key, signed by `issuer` (or by itself).
+fn issue(cn: &str, issuer: Option<&Party>, valid: (u32, u32), extensions: &[Vec<u8>]) -> Party {
+    let key = PrivateKey::generate_p256().unwrap();
+    let name = Name::build(cn, "", "Chain Tests", "", "US");
+    let signer = issuer.map_or(&key, |i| &i.key);
+    let issuer_name = issuer.map_or(&name, |i| &i.name);
+    let alg = signer.preferred_digest();
+    let sig_alg = signer.signature_algorithm(alg);
+    let exts: Vec<&[u8]> = extensions.iter().map(Vec::as_slice).collect();
+    let mut fields: Vec<Vec<u8>> = Vec::new();
+    // v3 when there are extensions; with none, a v1 certificate (no version field), as old roots.
+    if !exts.is_empty() {
+        fields.push(der::explicit(0, &der::int(2)));
+    }
+    fields.extend([
+        der::uint(&[1 + cn.len() as u8]),
+        sig_alg.clone(),
+        issuer_name.raw.clone(),
+        der::seq(&[&time(valid.0).encode(), &time(valid.1).encode()]),
+        name.raw.clone(),
+        key.public_key().spki(),
+    ]);
+    if !exts.is_empty() {
+        fields.push(der::explicit(3, &der::seq(&exts)));
+    }
+    let refs: Vec<&[u8]> = fields.iter().map(Vec::as_slice).collect();
+    let tbs = der::seq(&refs);
+    let signature = signer.sign(alg, &tbs).unwrap();
+    let cert = Certificate::parse(&der::seq(&[&tbs, &sig_alg, &der::bit_string(&signature)])).unwrap();
+    Party { name, key, cert }
+}
+
+const FOREVER: (u32, u32) = (2020, 2040);
+
+fn root() -> Party {
+    issue("Test Root", None, FOREVER, &[basic_constraints(true, None), key_usage(KEY_CERT_SIGN)])
+}
+
+fn ca(cn: &str, under: &Party, path_len: Option<u64>) -> Party {
+    issue(cn, Some(under), FOREVER, &[basic_constraints(true, path_len), key_usage(KEY_CERT_SIGN)])
+}
+
+fn end_entity(cn: &str, under: &Party) -> Party {
+    issue(cn, Some(under), FOREVER, &[basic_constraints(false, None), key_usage(DIGITAL_SIGNATURE)])
+}
+
+fn names(chain: &[&Certificate]) -> Vec<String> {
+    chain.iter().map(|c| c.subject.common_name().unwrap_or_default().to_string()).collect()
+}
+
+#[test]
+fn a_proper_chain_is_built() {
+    let r = root();
+    let i = ca("Intermediate", &r, None);
+    let l = end_entity("Leaf", &i);
+    let pool = [i.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf", "Intermediate", "Test Root"]);
+    assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2026)))), ["Leaf", "Intermediate", "Test Root"]);
+}
+
+#[test]
+fn an_end_entity_certificate_cannot_issue() {
+    let r = root();
+    let e = end_entity("Ordinary Subscriber", &r);
+    // A certificate its holder made with the end-entity key.
+    let forged = end_entity("Bank AG", &e);
+    let pool = [e.cert.clone(), r.cert.clone()];
+    let (chain, why) = build_chain_noted(&forged.cert, &pool, None);
+    assert_eq!(names(&chain), ["Bank AG"], "the subscriber certificate does not vouch for what it signed");
+    let why = why.unwrap();
+    assert_eq!(why.why, RefusedWhy::NotCa, "the reason is reported");
+    assert_eq!((why.issuer, why.subject), (&e.cert, &forged.cert), "with the two certificates it is about");
+    // Neither does one without basicConstraints (not a v1 root: it has an issuer).
+    let plain = issue("No Constraints", Some(&r), FOREVER, &[]);
+    let under_plain = end_entity("Under Plain", &plain);
+    let pool = [plain.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&under_plain.cert, &pool, None)), ["Under Plain"]);
+    // CA:TRUE does not help when keyUsage leaves out keyCertSign…
+    let signing_only = issue("Signing Only CA", Some(&r), FOREVER, &[basic_constraints(true, None), key_usage(DIGITAL_SIGNATURE)]);
+    let below = end_entity("Below Signing Only", &signing_only);
+    let pool = [signing_only.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&below.cert, &pool, None)), ["Below Signing Only"]);
+    // …and a CA with no keyUsage at all is fine.
+    let any_usage = issue("Any Usage CA", Some(&r), FOREVER, &[basic_constraints(true, None)]);
+    let below = end_entity("Below Any Usage", &any_usage);
+    let pool = [any_usage.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&below.cert, &pool, None)), ["Below Any Usage", "Any Usage CA", "Test Root"]);
+}
+
+#[test]
+fn a_path_length_constraint_limits_the_cas_below() {
+    let r = root();
+    let i1 = ca("Constrained", &r, Some(0));
+    let i2 = ca("Sub CA", &i1, None);
+    let l = end_entity("Leaf", &i2);
+    let pool = [i1.cert.clone(), i2.cert.clone(), r.cert.clone()];
+    // pathLen 0: no CA may follow it, so Sub CA's issuer is refused and the chain stops there.
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf", "Sub CA"]);
+    assert_eq!(build_chain_noted(&l.cert, &pool, None).1.map(|w| w.why), Some(RefusedWhy::PathLength));
+    // pathLen 0 directly above the leaf is fine, and pathLen 1 allows one CA below.
+    let direct = end_entity("Direct Leaf", &i1);
+    assert_eq!(names(&build_chain(&direct.cert, &pool, None)), ["Direct Leaf", "Constrained", "Test Root"]);
+    let i1 = ca("Constrained 1", &r, Some(1));
+    let i2 = ca("Sub CA 1", &i1, None);
+    let l = end_entity("Leaf 1", &i2);
+    let pool = [i1.cert.clone(), i2.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf 1", "Sub CA 1", "Constrained 1", "Test Root"]);
+}
+
+#[test]
+fn issuers_must_have_been_valid_when_it_matters() {
+    let r = root();
+    let old = issue("Short Lived CA", Some(&r), (2020, 2022), &[basic_constraints(true, None), key_usage(KEY_CERT_SIGN)]);
+    let l = end_entity("Leaf", &old);
+    let pool = [old.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2021)))), ["Leaf", "Short Lived CA", "Test Root"]);
+    let (chain, why) = build_chain_noted(&l.cert, &pool, Some(time(2023)));
+    assert_eq!(names(&chain), ["Leaf"], "expired by then");
+    assert_eq!(why.map(|w| w.why), Some(RefusedWhy::NotValid));
+    assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2019)))), ["Leaf"], "not yet valid");
+    // With no time to judge by, nothing is refused on validity.
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)).len(), 3);
+}
+
+#[test]
+fn an_old_v1_self_signed_root_without_constraints_still_anchors() {
+    // No extensions at all: basicConstraints absent, as in v1 roots.
+    let r = issue("Old V1 Root", None, FOREVER, &[]);
+    assert!(r.cert.is_self_signed() && !r.cert.has_basic_constraints && r.cert.may_issue());
+    let i = ca("Under V1", &r, None);
+    let l = end_entity("Leaf", &i);
+    let pool = [i.cert.clone(), r.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf", "Under V1", "Old V1 Root"]);
+    // A self-signed certificate that says CA:FALSE is not a root that can issue.
+    let not_a_ca = issue("Self Signed Leaf", None, FOREVER, &[basic_constraints(false, None)]);
+    assert!(!not_a_ca.cert.may_issue());
+}
+
+#[test]
+fn a_v3_self_signed_certificate_without_constraints_is_not_a_root_that_issues() {
+    // A self-signed v3 ID with no basicConstraints and no key usage (only a key identifier): it
+    // may sign documents, but it may not vouch for anyone else.
+    let id = issue("Self Signed V3 ID", None, FOREVER, &[ext("2.5.29.14", &der::octets(&[1, 2, 3, 4]))]);
+    assert!(id.cert.is_self_signed() && !id.cert.has_basic_constraints && id.cert.version == 2);
+    assert!(!id.cert.may_issue());
+    let l = end_entity("Leaf", &id);
+    assert_eq!(names(&build_chain(&l.cert, std::slice::from_ref(&id.cert), None)), ["Leaf"]);
+}
+
+const KEY_ENCIPHERMENT: u8 = 0x20;
+const SERVER_AUTH: &str = "1.3.6.1.5.5.7.3.1";
+
+fn extended_key_usage(oids: &[&str]) -> Vec<u8> {
+    let encoded: Vec<Vec<u8>> = oids.iter().map(|o| der::oid(o)).collect();
+    let refs: Vec<&[u8]> = encoded.iter().map(Vec::as_slice).collect();
+    der::seq(&[&der::oid("2.5.29.37"), &der::octets(&der::seq(&refs))])
+}
+
+fn signer_with(cn: &str, under: &Party, extensions: &[Vec<u8>]) -> Party {
+    let mut all = vec![basic_constraints(false, None)];
+    all.extend_from_slice(extensions);
+    issue(cn, Some(under), FOREVER, &all)
+}
+
+#[test]
+fn the_signer_certificate_must_allow_document_signing() {
+    let r = root();
+    let problem = |exts: &[Vec<u8>]| signer_with("Signer", &r, exts).cert.signing_problem();
+    // Key usage without digitalSignature or nonRepudiation.
+    assert_eq!(problem(&[key_usage(KEY_CERT_SIGN)]), Some(SigningProblem::KeyUsage));
+    assert!(problem(&[key_usage(KEY_ENCIPHERMENT)]).is_some());
+    assert!(problem(&[key_usage(DIGITAL_SIGNATURE)]).is_none());
+    // nonRepudiation alone is enough.
+    assert!(problem(&[key_usage(0x40)]).is_none());
+    // Extended key usage without a document-signing purpose.
+    assert_eq!(problem(&[extended_key_usage(&[SERVER_AUTH])]), Some(SigningProblem::ExtendedKeyUsage));
+    for ok in ["2.5.29.37.0", "1.3.6.1.5.5.7.3.4", "1.3.6.1.5.5.7.3.36", "1.2.840.113583.1.1.5", "1.3.6.1.4.1.311.10.3.12"] {
+        assert!(problem(&[extended_key_usage(&[SERVER_AUTH, ok])]).is_none(), "{ok}");
+    }
+    // An unknown critical extension refuses; the same extension non-critical does not.
+    let unknown = "1.2.3.4.5.6";
+    assert_eq!(problem(&[ext(unknown, &der::octets(&[0]))]), Some(SigningProblem::UnknownCritical(vec![unknown.to_string()])));
+    assert!(problem(&[der::seq(&[&der::oid(unknown), &der::octets(&der::octets(&[0]))])]).is_none());
+    // Critical extensions this crate knows, or may accept as they are, don't refuse.
+    assert!(problem(&[ext("2.5.29.32", &der::seq(&[]))]).is_none());
+    // No extensions at all, and the self-signed certificates this crate makes, may sign.
+    assert!(issue("Plain", Some(&r), FOREVER, &[]).cert.signing_problem().is_none());
+    let key = PrivateKey::generate_p256().unwrap();
+    let name = Name::build("Own ID", "", "", "", "US");
+    assert!(Certificate::self_signed(&name, &key, time(2026), 5, &[1]).unwrap().signing_problem().is_none());
+}
+
+#[test]
+fn a_smart_cards_certificates_that_may_not_sign_say_why() {
+    // A DoD CAC's four certificates, all under the same name; only the signing one may sign.
+    let r = root();
+    let problem = |exts: &[Vec<u8>]| signer_with("DOE.JANE.1234567890", &r, exts).cert.signing_problem();
+    let encryption = problem(&[key_usage(KEY_ENCIPHERMENT), extended_key_usage(&["1.3.6.1.5.5.7.3.4"])]);
+    assert_eq!(encryption, Some(SigningProblem::KeyUsage));
+    let logon = problem(&[key_usage(DIGITAL_SIGNATURE), extended_key_usage(&["1.3.6.1.4.1.311.20.2.2", "1.3.6.1.5.5.7.3.2"])]);
+    assert_eq!(logon, Some(SigningProblem::ExtendedKeyUsage));
+    let card_auth = problem(&[key_usage(DIGITAL_SIGNATURE), extended_key_usage(&["2.16.840.1.101.3.6.8"])]);
+    assert_eq!(card_auth, logon);
+    let signing = problem(&[key_usage(DIGITAL_SIGNATURE | 0x40), extended_key_usage(&["1.3.6.1.5.5.7.3.4", "1.3.6.1.4.1.311.10.3.12"])]);
+    assert_eq!(signing, None);
+}
+
+#[test]
+fn unreadable_constraint_extensions_fail_closed() {
+    // keyUsage present but not a BIT STRING: no usage at all, so no keyCertSign.
+    let bad_usage = ext("2.5.29.15", &[0xff, 0x00]);
+    let c = issue("Bad Usage CA", Some(&root()), FOREVER, &[basic_constraints(true, None), bad_usage]);
+    assert_eq!(c.cert.key_usage, Some(0));
+    assert!(!c.cert.may_issue());
+    // pathLenConstraint present but negative: no CA may follow, not any number.
+    let negative = ext("2.5.29.19", &der::seq(&[&der::boolean(true), &der::tlv(tag::INTEGER, &[0xff])]));
+    let c = issue("Negative PathLen CA", Some(&root()), FOREVER, &[negative]);
+    assert!(c.cert.is_ca);
+    assert_eq!(c.cert.path_len, Some(0));
+    // basicConstraints present but unparsable: present, not a CA, so not an "old v1 root".
+    let garbage = ext("2.5.29.19", &[0x30, 0x05, 0x01]);
+    let c = issue("Garbled Constraints", None, FOREVER, &[garbage]);
+    assert!(c.cert.has_basic_constraints && !c.cert.is_ca && !c.cert.may_issue());
+}
+
+#[test]
+fn an_unreadable_extended_key_usage_allows_no_purpose() {
+    // An extendedKeyUsage that is present restricts the key even when it doesn't parse:
+    // truncated, critical or not; a SET instead of a SEQUENCE; or a member that isn't an OID.
+    // Each would otherwise read as "no restriction", or as only its readable members.
+    let r = root();
+    let any = der::oid("2.5.29.37.0");
+    let truncated = [0x30, 0x05, 0x06];
+    let malformed = [
+        ext("2.5.29.37", &truncated),
+        der::seq(&[&der::oid("2.5.29.37"), &der::octets(&truncated)]),
+        ext("2.5.29.37", &der::tlv(tag::SET, &any)),
+        ext("2.5.29.37", &der::seq(&[&der::int(1), &any])),
+    ];
+    for (i, eku) in malformed.into_iter().enumerate() {
+        let signer = signer_with("Malformed EKU", &r, &[key_usage(DIGITAL_SIGNATURE), eku]);
+        assert_eq!(signer.cert.extended_key_usage.as_deref(), Some(&[][..]), "case {i}");
+        assert_eq!(signer.cert.signing_problem(), Some(SigningProblem::ExtendedKeyUsage), "case {i}");
+    }
+    // The same document-signing purpose, well formed, may sign.
+    let good = signer_with("Good EKU", &r, &[key_usage(DIGITAL_SIGNATURE), extended_key_usage(&["2.5.29.37.0"])]);
+    assert_eq!(good.cert.signing_problem(), None);
+}
+
+/// A CA certificate with a critical extension this crate does not enforce (here name constraints)
+/// vouches for nothing: what that extension limits would go unchecked. A self-signed root's
+/// extensions are the trust store's business, so such a root still anchors.
+#[test]
+fn an_issuer_with_an_unprocessed_critical_extension_does_not_vouch() {
+    let name_constraints = ext("2.5.29.30", &der::seq(&[]));
+    let r = root();
+    let constrained =
+        issue("Name Constrained CA", Some(&r), FOREVER, &[basic_constraints(true, None), key_usage(KEY_CERT_SIGN), name_constraints.clone()]);
+    let l = end_entity("Outside Its Names", &constrained);
+    let pool = [constrained.cert.clone(), r.cert.clone()];
+    let (chain, why) = build_chain_noted(&l.cert, &pool, None);
+    assert_eq!(names(&chain), ["Outside Its Names"]);
+    assert_eq!(why.map(|w| w.why), Some(RefusedWhy::UnknownCritical), "the reason is reported");
+    let constrained_root =
+        issue("Name Constrained Root", None, FOREVER, &[basic_constraints(true, None), key_usage(KEY_CERT_SIGN), name_constraints]);
+    let i = ca("Under Constrained Root", &constrained_root, None);
+    let l = end_entity("Leaf", &i);
+    let pool = [i.cert.clone(), constrained_root.cert.clone()];
+    assert_eq!(names(&build_chain(&l.cert, &pool, None)), ["Leaf", "Under Constrained Root", "Name Constrained Root"]);
+}
diff --git a/crates/pkcs7/tests/it/cms.rs b/crates/pkcs7/tests/it/cms.rs
new file mode 100644
index 000000000..593a67ba2
--- /dev/null
+++ b/crates/pkcs7/tests/it/cms.rs
@@ -0,0 +1,130 @@
+//! What a CMS's signed attributes may hold. RFC 5652 allows one content-type and one
+//! message-digest attribute, each with one value, and the content type must be the type of the
+//! encapsulated content. Both content types are object identifiers.
+//!
+//! These go through `SignedData::parse`, the way a PDF's signature reaches it. Each CMS is built
+//! here as the signer builds it, so a case differs from a valid one only where it says.
+
+use craft_pkcs7::cms::SignedData;
+use craft_pkcs7::der::{self, tag};
+use craft_pkcs7::keys::DigestAlg;
+use craft_pkcs7::{Error, pkcs12};
+
+const SIGNED_DATA: &str = "1.2.840.113549.1.7.2";
+const DATA: &str = "1.2.840.113549.1.7.1";
+const TST_INFO: &str = "1.2.840.113549.1.9.16.1.4";
+const CONTENT_TYPE: &str = "1.2.840.113549.1.9.3";
+const MESSAGE_DIGEST: &str = "1.2.840.113549.1.9.4";
+
+fn identity() -> pkcs12::DigitalId {
+    let p12 = std::fs::read(format!("{}/tests/data/rsa-aes.p12", env!("CARGO_MANIFEST_DIR"))).unwrap();
+    pkcs12::open(&p12, "test").unwrap()
+}
+
+/// A signed attribute: its type and the SET of its values.
+fn attribute(oid: &str, values: &[&[u8]]) -> Vec<u8> {
+    der::seq(&[&der::oid(oid), &der::set_of(values)])
+}
+
+/// A SignedData whose encapsulated content has the type `encap_type` and whose one signer
+/// signed the attributes `attrs`.
+fn signed_data(id: &pkcs12::DigitalId, encap_type: &str, attrs: &[Vec<u8>]) -> Vec<u8> {
+    signed_data_with_encap(id, &der::seq(&[&der::oid(encap_type)]), attrs)
+}
+
+/// A SignedData with the encapContentInfo `encap`, as it stands, and whose one signer signed the
+/// attributes `attrs`.
+fn signed_data_with_encap(id: &pkcs12::DigitalId, encap: &[u8], attrs: &[Vec<u8>]) -> Vec<u8> {
+    let alg = DigestAlg::Sha256;
+    let refs: Vec<&[u8]> = attrs.iter().map(Vec::as_slice).collect();
+    let set = der::set_of(&refs);
+    let signature = id.key.sign(alg, &set).unwrap();
+    let mut signed_attrs = set;
+    signed_attrs[0] = tag::ctx(0);
+    let cert = &id.certificate;
+    let sid = der::seq(&[&cert.issuer.raw, &der::uint(&cert.serial)]);
+    let signer = der::seq(&[&der::int(1), &sid, &alg.algorithm(), &signed_attrs, &id.key.signature_algorithm(alg), &der::octets(&signature)]);
+    let signed_data =
+        der::seq(&[&der::int(1), &der::set_of(&[&alg.algorithm()]), encap, &der::tlv(tag::ctx(0), &cert.raw), &der::set_of(&[&signer])]);
+    der::seq(&[&der::oid(SIGNED_DATA), &der::explicit(0, &signed_data)])
+}
+
+/// Why `SignedData::parse` refuses `cms`.
+fn refused(cms: &[u8]) -> String {
+    match SignedData::parse(cms) {
+        Err(Error::Malformed(why)) => why,
+        other => panic!("expected the CMS to be refused, got {other:?}"),
+    }
+}
+
+#[test]
+fn signed_attributes_hold_one_content_type_and_one_message_digest() {
+    let id = identity();
+    let digest = DigestAlg::Sha256.digest(&[b"document"]);
+    let (data, tst, md, other_md) = (der::oid(DATA), der::oid(TST_INFO), der::octets(&digest), der::octets(&[0; 32]));
+    let content_type = attribute(CONTENT_TYPE, &[&data]);
+    let message_digest = attribute(MESSAGE_DIGEST, &[&md]);
+
+    // As a signer writes them: read, and the signature over them verifies.
+    let sd = SignedData::parse(&signed_data(&id, DATA, &[content_type.clone(), message_digest.clone()])).unwrap();
+    assert_eq!(sd.signer.content_type.as_deref(), Some(DATA));
+    assert_eq!(sd.signer.message_digest.as_deref(), Some(digest.as_slice()));
+    assert!(sd.verify_signature(&id.certificate, &digest).unwrap());
+
+    // A second attribute of either kind, with the same value or another one, and an attribute
+    // with two values or none.
+    for (attrs, what) in [
+        (vec![content_type.clone(), content_type.clone(), message_digest.clone()], "content type"),
+        (vec![content_type.clone(), attribute(CONTENT_TYPE, &[&tst]), message_digest.clone()], "content type"),
+        (vec![attribute(CONTENT_TYPE, &[&data, &tst]), message_digest.clone()], "content type"),
+        (vec![attribute(CONTENT_TYPE, &[]), message_digest.clone()], "content type"),
+        (vec![content_type.clone(), message_digest.clone(), message_digest.clone()], "message digest"),
+        (vec![content_type.clone(), message_digest.clone(), attribute(MESSAGE_DIGEST, &[&other_md])], "message digest"),
+        (vec![content_type.clone(), attribute(MESSAGE_DIGEST, &[&md, &other_md])], "message digest"),
+        (vec![content_type.clone(), attribute(MESSAGE_DIGEST, &[])], "message digest"),
+    ] {
+        let why = refused(&signed_data(&id, DATA, &attrs));
+        assert!(why.contains(&format!("one {what} with one value")), "{why}");
+    }
+}
+
+#[test]
+fn the_signed_content_type_is_the_type_of_the_encapsulated_content() {
+    let id = identity();
+    let digest = DigestAlg::Sha256.digest(&[b"document"]);
+    let message_digest = attribute(MESSAGE_DIGEST, &[&der::octets(&digest)]);
+    let signed_as = |oid: &str| attribute(CONTENT_TYPE, &[&der::oid(oid)]);
+
+    // A PDF signature names data in both places, and an RFC 3161 token names TSTInfo in both.
+    SignedData::parse(&signed_data(&id, DATA, &[signed_as(DATA), message_digest.clone()])).unwrap();
+    SignedData::parse(&signed_data(&id, TST_INFO, &[signed_as(TST_INFO), message_digest.clone()])).unwrap();
+
+    // The signature does not cover eContentType: here it was changed from data to signedData
+    // (the last byte of the OID), and the signed attributes still say data.
+    let why = refused(&signed_data(&id, SIGNED_DATA, &[signed_as(DATA), message_digest.clone()]));
+    assert!(why.contains("not the encapsulated content type"), "{why}");
+
+    // Without a content-type attribute there is nothing to compare here. The type is kept, and a
+    // PDF signature's validation refuses one that is not data.
+    let sd = SignedData::parse(&signed_data(&id, SIGNED_DATA, std::slice::from_ref(&message_digest))).unwrap();
+    assert_eq!(sd.econtent_type, SIGNED_DATA);
+}
+
+#[test]
+fn content_types_are_object_identifiers() {
+    let id = identity();
+    let digest = DigestAlg::Sha256.digest(&[b"document"]);
+    let message_digest = attribute(MESSAGE_DIGEST, &[&der::octets(&digest)]);
+    let content_type = attribute(CONTENT_TYPE, &[&der::oid(DATA)]);
+    let not_an_oid = der::octets(DATA.as_bytes());
+
+    // A content-type value that is not an OID would leave nothing to compare.
+    let why = refused(&signed_data(&id, DATA, &[attribute(CONTENT_TYPE, &[&not_an_oid]), message_digest.clone()]));
+    assert!(why.contains("expected an OID"), "{why}");
+
+    // eContentType is required (RFC 5652 §5.2) and is an OID.
+    let why = refused(&signed_data_with_encap(&id, &der::seq(&[&not_an_oid]), &[content_type.clone(), message_digest.clone()]));
+    assert!(why.contains("expected an OID"), "{why}");
+    let why = refused(&signed_data_with_encap(&id, &der::seq(&[]), &[content_type, message_digest]));
+    assert!(why.contains("eContentType"), "{why}");
+}
diff --git a/crates/pkcs7/tests/it/crypto.rs b/crates/pkcs7/tests/it/crypto.rs
new file mode 100644
index 000000000..da82f5e87
--- /dev/null
+++ b/crates/pkcs7/tests/it/crypto.rs
@@ -0,0 +1,812 @@
+//! The cryptographic core against files made by OpenSSL 3 (tests/data/README.md).
+
+use craft_pkcs7::der::{Time, Tlv};
+use craft_pkcs7::keys::DigestAlg;
+use craft_pkcs7::{Certificate, Error, Name, PublicKey, cms, pkcs12};
+
+fn data(name: &str) -> Vec<u8> {
+    std::fs::read(format!("{}/tests/data/{name}", env!("CARGO_MANIFEST_DIR"))).unwrap()
+}
+
+fn pem(name: &str) -> Vec<u8> {
+    let text = String::from_utf8(data(name)).unwrap();
+    let b64: String = text.lines().filter(|l| !l.starts_with("-----")).collect();
+    decode_base64(&b64)
+}
+
+fn decode_base64(s: &str) -> Vec<u8> {
+    let val = |c: u8| match c {
+        b'A'..=b'Z' => c - b'A',
+        b'a'..=b'z' => c - b'a' + 26,
+        b'0'..=b'9' => c - b'0' + 52,
+        b'+' => 62,
+        _ => 63,
+    };
+    let bytes: Vec<u8> = s.bytes().filter(|c| *c != b'=').map(val).collect();
+    bytes
+        .chunks(4)
+        .flat_map(|c| {
+            let n = c.iter().enumerate().fold(0u32, |acc, (i, v)| acc | (*v as u32) << (18 - 6 * i));
+            let k = c.len() * 6 / 8;
+            (0..k).map(move |i| (n >> (16 - 8 * i)) as u8)
+        })
+        .collect()
+}
+
+#[test]
+fn opens_every_openssl_flavour_of_pkcs12() {
+    for (file, cn, key) in [
+        ("rsa-aes.p12", "Test Signer RSA", "RSA 2048-bit"),
+        ("rsa-legacy.p12", "Test Signer RSA", "RSA 2048-bit"),
+        ("ec-p256.p12", "Test Signer EC", "ECDSA P-256"),
+        ("ec-p384.p12", "Test Signer P384", "ECDSA P-384"),
+        ("chain.p12", "Ada Lovelace", "RSA 2048-bit"),
+    ] {
+        let id = pkcs12::open(&data(file), "test").unwrap_or_else(|e| panic!("{file}: {e}"));
+        assert_eq!(id.certificate.subject.common_name(), Some(cn), "{file}");
+        assert_eq!(id.key.public_key().describe(), key, "{file}");
+        assert_eq!(&id.certificate.public_key, id.key.public_key());
+        assert!(matches!(pkcs12::open(&data(file), "nope"), Err(Error::WrongPassword)), "{file}");
+    }
+    assert_eq!(pkcs12::open(&data("rsa-aes.p12"), "test").unwrap().friendly_name.as_deref(), Some("Test Signer RSA"));
+    let chain = pkcs12::open(&data("chain.p12"), "test").unwrap();
+    assert_eq!(chain.chain.len(), 1);
+    assert_eq!(chain.certificate.subject.email(), Some("ada@example.com"));
+    assert!(chain.chain[0].is_ca && chain.chain[0].is_self_signed());
+    assert!(chain.certificate.signed_by(&chain.chain[0].public_key), "the leaf is issued by the root");
+    assert!(!chain.certificate.is_self_signed());
+    assert_eq!(chain.certificate.key_usage.map(|u| u & 0b11), Some(0b11), "digitalSignature + nonRepudiation");
+}
+
+/// One element with BER's indefinite length: contents, then the end-of-contents octets.
+fn indefinite(tag: u8, body: &[u8]) -> Vec<u8> {
+    let mut v = vec![tag, 0x80];
+    v.extend_from_slice(body);
+    v.extend([0, 0]);
+    v
+}
+
+/// An OCTET STRING split into segments, BER's constructed form.
+fn segmented(bytes: &[u8]) -> Vec<u8> {
+    let parts: Vec<u8> = bytes.chunks(64).flat_map(der::octets).collect();
+    indefinite(0x24, &parts)
+}
+
+/// A `.p12` in the shape Windows writes one: the PFX, its ContentInfo and the `[0]` holding the
+/// AuthenticatedSafe all in the indefinite form, and the AuthenticatedSafe split into segments.
+/// Nothing changes meaning, and the MAC still covers the same octets, so whatever a reader makes
+/// of it, it is making it of the form and not of the contents.
+///
+/// With `deep`, every ContentInfo inside is rewritten the same way, as a real Windows file has it.
+/// That re-encodes the AuthenticatedSafe, which is what the MAC covers, so the MacData is dropped
+/// — RFC 7292 §4 makes it optional — and a wrong password is then caught by the decryption.
+fn as_windows_writes_it(der: &[u8], deep: bool) -> Vec<u8> {
+    let pfx = Tlv::parse_all(der).unwrap().children().unwrap();
+    let auth = pfx[1].children().unwrap();
+    let mut content = auth[1].inner().unwrap().value.to_vec();
+    if deep {
+        let mut inner = Vec::new();
+        for ci in Tlv::parse_all(&content).unwrap().children().unwrap() {
+            let p = ci.children().unwrap();
+            let body = p[1].inner().unwrap();
+            // A Data content is an OCTET STRING, so it gets segmented; an EncryptedData is a
+            // SEQUENCE and stays as it is inside its indefinite wrappers.
+            let wrapped = if body.tag == 0x04 { segmented(body.value) } else { body.raw.to_vec() };
+            let zero = indefinite(0xA0, &wrapped);
+            inner.extend(indefinite(0x30, &[p[0].raw, zero.as_slice()].concat()));
+        }
+        content = indefinite(0x30, &inner);
+    }
+    let zero = indefinite(0xA0, &segmented(&content));
+    let mut body = pfx[0].raw.to_vec();
+    body.extend(indefinite(0x30, &[auth[0].raw, zero.as_slice()].concat()));
+    if !deep {
+        for extra in &pfx[2..] {
+            body.extend_from_slice(extra.raw);
+        }
+    }
+    indefinite(0x30, &body)
+}
+
+#[test]
+fn opens_pkcs12_as_windows_writes_it() {
+    for file in ["rsa-aes.p12", "rsa-legacy.p12", "chain.p12"] {
+        let der = data(file);
+        let want = pkcs12::open(&der, "test").unwrap();
+        for deep in [false, true] {
+            let ber = as_windows_writes_it(&der, deep);
+            assert_ne!(ber, der, "{file} ({deep})");
+            let got = pkcs12::open(&ber, "test").unwrap_or_else(|e| panic!("{file} in BER (deep: {deep}): {e}"));
+            assert_eq!(got.certificate.raw, want.certificate.raw, "{file} ({deep})");
+            assert_eq!(got.key.public_key(), want.key.public_key(), "{file} ({deep})");
+            assert_eq!(got.chain.len(), want.chain.len(), "{file} ({deep})");
+            assert_eq!(got.friendly_name, want.friendly_name, "{file} ({deep})");
+            assert!(matches!(pkcs12::open(&ber, "nope"), Err(Error::WrongPassword)), "{file} ({deep})");
+        }
+    }
+}
+
+#[test]
+fn certificates_parse_as_openssl_made_them() {
+    let c = Certificate::parse(&pem("rsa.crt.pem")).unwrap();
+    // (The organisation name is what the fixtures were made with.)
+    assert_eq!(c.subject.display(), "CN=Test Signer RSA, O=PrintCraft Tests, C=US");
+    assert_eq!(c.serial_hex(), "03E9");
+    assert!(c.is_self_signed());
+    assert!(c.not_after.year >= c.not_before.year + 9);
+    let ca = Certificate::parse(&pem("ca.crt.pem")).unwrap();
+    assert!(ca.is_ca && ca.is_self_signed());
+    assert!(matches!(ca.public_key, PublicKey::P256(_)));
+}
+
+#[test]
+fn signatures_round_trip_for_every_key_type() {
+    for file in ["rsa-aes.p12", "ec-p256.p12", "ec-p384.p12", "chain.p12"] {
+        let id = pkcs12::open(&data(file), "test").unwrap();
+        let alg = id.key.preferred_digest();
+        let digest = alg.digest(&[b"the document bytes"]);
+        let sig = cms::sign_detached(&id.key, &id.certificate, &id.chain, alg, &digest).unwrap();
+        let mut padded = sig.clone();
+        padded.extend([0u8; 64]);
+        let sd = cms::SignedData::parse(&padded).unwrap();
+        let signer = sd.signer_certificate().expect("the signer's certificate is embedded");
+        assert_eq!(signer, &id.certificate);
+        assert_eq!(sd.signer.message_digest.as_deref(), Some(&digest[..]));
+        assert!(sd.signer.signing_certificate, "CAdES signing-certificate-v2");
+        assert!(sd.verify_signature(signer, &digest).unwrap(), "{file}");
+        assert_eq!(sd.certificates.len(), 1 + id.chain.len());
+        // Tampering with the signature breaks it.
+        let mut bad = sd.clone();
+        bad.signer.signature[5] ^= 1;
+        assert!(!bad.verify_signature(signer, &digest).unwrap(), "{file}");
+    }
+}
+
+#[test]
+fn new_digital_ids_are_self_signed_and_survive_a_p12_round_trip() {
+    let name = Name::build("Grace Hopper", "Compilers", "Navy", "grace@example.com", "us");
+    let now = Time { year: 2026, month: 10, day: 2, hour: 12, minute: 0, second: 0 };
+    for key in [craft_pkcs7::PrivateKey::generate_rsa(2048).unwrap(), craft_pkcs7::PrivateKey::generate_p256().unwrap()] {
+        let cert = Certificate::self_signed(&name, &key, now, 5, &[0x42, 0x01]).unwrap();
+        assert!(cert.is_self_signed());
+        assert_eq!(cert.subject.display(), "C=US, O=Navy, OU=Compilers, CN=Grace Hopper, E=grace@example.com");
+        assert_eq!(cert.not_after.year, 2031);
+        assert_eq!(cert.key_usage.map(|u| u & 0b11), Some(0b11));
+        let id = pkcs12::DigitalId { key, certificate: cert, chain: Vec::new(), friendly_name: Some("Grace Hopper".into()) };
+        let p12 = pkcs12::write(&id, "s3cret").unwrap();
+        let back = pkcs12::open(&p12, "s3cret").unwrap();
+        assert_eq!(back.certificate, id.certificate);
+        assert_eq!(back.friendly_name.as_deref(), Some("Grace Hopper"));
+        assert!(matches!(pkcs12::open(&p12, "wrong"), Err(Error::WrongPassword)));
+        let d = DigestAlg::Sha256.digest(&[b"x"]);
+        let sig = cms::sign_detached(&back.key, &back.certificate, &[], DigestAlg::Sha256, &d).unwrap();
+        let sd = cms::SignedData::parse(&sig).unwrap();
+        assert!(sd.verify_signature(&back.certificate, &d).unwrap());
+    }
+}
+
+#[test]
+fn new_digital_ids_use_the_stronger_round_count_for_the_key_and_the_mac() {
+    let name = Name::build("Grace Hopper", "", "", "", "");
+    let now = Time { year: 2026, month: 10, day: 14, hour: 12, minute: 0, second: 0 };
+    let key = craft_pkcs7::PrivateKey::generate_p256().unwrap();
+    let certificate = Certificate::self_signed(&name, &key, now, 5, &[0x42]).unwrap();
+    let id = pkcs12::DigitalId { key, certificate, chain: Vec::new(), friendly_name: None };
+    let p12 = pkcs12::write(&id, "s3cret12").unwrap();
+    // OWASP's figure for PBKDF2-HMAC-SHA-256, spelled out so lowering the constant fails here.
+    const ROUNDS: u64 = 600_000;
+    // MacData's iteration count, the last field of the file.
+    let pfx = Tlv::parse_all(&p12).unwrap().children().unwrap();
+    let mac = pfx[2].children().unwrap();
+    assert_eq!(mac[2].u64().unwrap(), ROUNDS);
+    // The same INTEGER three times: the MAC and the PBKDF2 parameters of both encrypted parts.
+    let rounds = craft_pkcs7::der::int(ROUNDS);
+    assert_eq!(p12.windows(rounds.len()).filter(|w| *w == rounds.as_slice()).count(), 3);
+    assert_eq!(pkcs12::open(&p12, "s3cret12").unwrap().certificate, id.certificate);
+}
+
+/// A `.p12` whose MAC asks for `rounds` iterations. Its content is empty: opening it must stop
+/// at the MAC, before the content is read.
+fn p12_with_mac_rounds(rounds: u64) -> Vec<u8> {
+    use craft_pkcs7::der;
+    let auth_safe = der::seq(&[]);
+    let digest = der::seq(&[&DigestAlg::Sha256.algorithm(), &der::octets(&[0; 32])]);
+    let mac_data = der::seq(&[&digest, &der::octets(&[1; 16]), &der::int(rounds)]);
+    der::seq(&[&der::int(3), &der::seq(&[&der::oid("1.2.840.113549.1.7.1"), &der::explicit(0, &der::octets(&auth_safe))]), &mac_data])
+}
+
+#[test]
+fn a_p12_asking_for_too_many_rounds_is_refused_before_hashing() {
+    // 2^32 + 1 used to wrap to one round; 20 million took seconds and 4 billion about an hour,
+    // all spent on the password check.
+    for rounds in [(1u64 << 32) + 1, 20_000_000, 4_000_000_000] {
+        let err = pkcs12::open(&p12_with_mac_rounds(rounds), "password").expect_err("refused");
+        assert!(matches!(err, Error::Unsupported(_)), "{rounds}: {err}");
+    }
+    // An ordinary count still gets as far as the password.
+    assert!(matches!(pkcs12::open(&p12_with_mac_rounds(2048), "password"), Err(Error::WrongPassword)));
+}
+
+#[test]
+fn certificates_load_from_pem_and_der_and_export_as_pem() {
+    let pem_text = data("rsa.crt.pem");
+    let certs = craft_pkcs7::x509::load_certificates(&pem_text).unwrap();
+    assert_eq!(certs.len(), 1);
+    let der = certs[0].raw.clone();
+    assert_eq!(craft_pkcs7::x509::load_certificates(&der).unwrap()[0], certs[0]);
+    let back = craft_pkcs7::x509::to_pem(&certs[0]);
+    assert_eq!(craft_pkcs7::x509::load_certificates(back.as_bytes()).unwrap()[0], certs[0]);
+    assert!(craft_pkcs7::x509::load_certificates(b"hello").is_err());
+}
+
+/// Base64 in 64-column lines, for PEM armour.
+fn encode_base64(der: &[u8]) -> String {
+    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    let mut s = String::new();
+    for c in der.chunks(3) {
+        let n = u32::from(c[0]) << 16 | u32::from(*c.get(1).unwrap_or(&0)) << 8 | u32::from(*c.get(2).unwrap_or(&0));
+        for i in 0..4 {
+            s.push(if i <= c.len() { T[(n >> (18 - 6 * i) & 63) as usize] as char } else { '=' });
+        }
+    }
+    let lines: Vec<&str> = s.as_bytes().chunks(64).map(|l| std::str::from_utf8(l).unwrap()).collect();
+    lines.join("\n")
+}
+
+/// A PKCS #7 certificate bundle (degenerate SignedData, RFC 5652 §5.2) holding `certs`, laid out
+/// as `openssl crl2pkcs7 -nocrl` writes it.
+fn p7b(certs: &[&[u8]]) -> Vec<u8> {
+    use craft_pkcs7::der::{explicit, int, oid, seq, set_of, tlv};
+    let encap = seq(&[&oid(cms::DATA)]);
+    let mut sd = vec![int(1), set_of(&[]), encap];
+    if !certs.is_empty() {
+        sd.push(tlv(0xA0, &certs.concat()));
+    }
+    sd.push(set_of(&[]));
+    let refs: Vec<&[u8]> = sd.iter().map(Vec::as_slice).collect();
+    seq(&[&oid(cms::SIGNED_DATA), &explicit(0, &seq(&refs))])
+}
+
+#[test]
+fn certificates_load_from_pkcs7_bundles() {
+    use craft_pkcs7::x509::{load_certificates, to_pem};
+    let leaf = load_certificates(&data("rsa.crt.pem")).unwrap().remove(0);
+    let root = load_certificates(&data("ca.crt.pem")).unwrap().remove(0);
+    let bundle = p7b(&[&leaf.raw, &root.raw]);
+    // .p7b / .p7c in DER, the way Windows and Acrobat export a chain.
+    assert_eq!(load_certificates(&bundle).unwrap(), vec![leaf.clone(), root.clone()]);
+    // The same bundle as PEM `PKCS7` and `CMS` blocks, after a key and a plain certificate.
+    let b64 = encode_base64(&bundle);
+    for label in ["PKCS7", "CMS"] {
+        let text = format!(
+            "-----BEGIN PRIVATE KEY-----\nAAAA\n-----END PRIVATE KEY-----\n{}-----BEGIN {label}-----\n{}\n-----END {label}-----\n",
+            to_pem(&leaf),
+            b64
+        );
+        assert_eq!(load_certificates(text.as_bytes()).unwrap(), vec![leaf.clone(), leaf.clone(), root.clone()], "{label}");
+    }
+    // An END that closes a different block ends nothing.
+    let mismatched = format!("-----BEGIN PKCS7-----\n{b64}\n-----END CERTIFICATE-----\n");
+    assert!(load_certificates(mismatched.as_bytes()).is_err());
+    // A block that never ends is a damaged file, not a shorter list.
+    let unclosed = format!("{}-----BEGIN PKCS7-----\n{b64}\n", to_pem(&leaf));
+    assert!(load_certificates(unclosed.as_bytes()).is_err());
+    // A bundle with no certificate, and a SignedData that isn't one, are errors, not empty lists.
+    assert!(load_certificates(&p7b(&[])).is_err());
+    let not_signed_data = craft_pkcs7::der::seq(&[&craft_pkcs7::der::oid(cms::DATA), &craft_pkcs7::der::explicit(0, &[])]);
+    assert!(load_certificates(&not_signed_data).is_err());
+    // A SignedData out of shape: no signerInfos SET, or a version that isn't an INTEGER.
+    {
+        use craft_pkcs7::der::{explicit, int, oid, seq, set_of, tlv};
+        let wrap = |sd: &[&[u8]]| seq(&[&oid(cms::SIGNED_DATA), &explicit(0, &seq(sd))]);
+        let (certs, encap) = (tlv(0xA0, &[leaf.raw.as_slice(), &root.raw].concat()), seq(&[&oid(cms::DATA)]));
+        assert_eq!(load_certificates(&wrap(&[&int(1), &set_of(&[]), &encap, &certs, &set_of(&[])])).unwrap().len(), 2);
+        assert!(load_certificates(&wrap(&[&int(1), &set_of(&[]), &encap, &certs])).is_err());
+        assert!(load_certificates(&wrap(&[&set_of(&[]), &set_of(&[]), &encap, &certs, &set_of(&[])])).is_err());
+        // An empty encapContentInfo, a repeated [0], and [1] CRLs before [0] certificates.
+        let crls = tlv(0xA1, &[]);
+        assert!(load_certificates(&wrap(&[&int(1), &set_of(&[]), &seq(&[]), &certs, &set_of(&[])])).is_err());
+        assert!(load_certificates(&wrap(&[&int(1), &set_of(&[]), &encap, &certs, &certs, &set_of(&[])])).is_err());
+        assert!(load_certificates(&wrap(&[&int(1), &set_of(&[]), &encap, &crls, &certs, &set_of(&[])])).is_err());
+        assert_eq!(load_certificates(&wrap(&[&int(1), &set_of(&[]), &encap, &certs, &crls, &set_of(&[])])).unwrap().len(), 2);
+    }
+    let mut trailing = bundle.clone();
+    trailing.extend_from_slice(&[0x05, 0x00]);
+    assert!(load_certificates(&trailing).is_err());
+    assert!(cms::certificate_bundle(&bundle).is_ok());
+    // Truncated anywhere: an error, never a panic.
+    for n in 0..bundle.len() {
+        let _ = load_certificates(&bundle[..n]);
+    }
+}
+
+// ── CRL and OCSP verification (RFC 5280, RFC 6960) ─────────────────────────────────────────
+
+use craft_pkcs7::der::{self, tag};
+use craft_pkcs7::revocation::{CertificateList, OcspResponse, RevocationStatus};
+
+/// A self-issued CRL from `issuer`: optional revocation entry, signed with the issuer's key.
+fn crl(issuer: &pkcs12::DigitalId, revoked_serial: Option<(&[u8], Time)>, this: Time, next: Time) -> Vec<u8> {
+    let alg = issuer.key.signature_algorithm(DigestAlg::Sha256);
+    let mut tbs = vec![der::int(1), alg.clone(), issuer.certificate.subject.raw.clone(), this.encode(), next.encode()];
+    if let Some((serial, at)) = revoked_serial {
+        tbs.push(der::seq(&[&der::seq(&[&der::uint(serial), &at.encode()])]));
+    }
+    let refs: Vec<&[u8]> = tbs.iter().map(Vec::as_slice).collect();
+    let tbs = der::seq(&refs);
+    let sig = issuer.key.sign(DigestAlg::Sha256, &tbs).unwrap();
+    der::seq(&[&tbs, &alg, &der::bit_string(&sig)])
+}
+
+/// A self-issued OCSP response from `issuer` answering for its own serial.
+fn ocsp(issuer: &pkcs12::DigitalId, status: RevocationStatus, this: Time, next: Time) -> Vec<u8> {
+    let cert_id = der::seq(&[
+        &DigestAlg::Sha1.algorithm(),
+        &der::octets(&DigestAlg::Sha1.digest(&[&issuer.certificate.issuer.raw])),
+        &der::octets(&DigestAlg::Sha1.digest(&[&issuer.certificate.public_key.key_bits()])),
+        &der::uint(&issuer.certificate.serial),
+    ]);
+    // RFC 6960's real encodings: good [0] IMPLICIT NULL, revoked [1] IMPLICIT RevokedInfo,
+    // unknown [2] IMPLICIT; nextUpdate [0] EXPLICIT GeneralizedTime.
+    let status = match status {
+        RevocationStatus::Good => der::tlv(tag::ctx_prim(0), &[]),
+        RevocationStatus::Revoked { at } => der::tlv(tag::ctx(1), &at.encode()),
+        RevocationStatus::Unknown => der::tlv(tag::ctx_prim(2), &[]),
+    };
+    let single = der::seq(&[&cert_id, &status, &this.encode(), &der::tlv(tag::ctx(0), &next.encode())]);
+    let responder_id = der::tlv(tag::ctx(1), &issuer.certificate.subject.raw);
+    signed_ocsp(&issuer.key, &responder_id, None, &single, this)
+}
+
+/// A successful OCSP response holding `single`, signed with `key` and naming its responder by
+/// `responder_id`, with `certs` (the encoded `[0]` field) if given.
+fn signed_ocsp(key: &craft_pkcs7::PrivateKey, responder_id: &[u8], certs: Option<&[u8]>, single: &[u8], at: Time) -> Vec<u8> {
+    let tbs = der::seq(&[responder_id, &at.encode(), &der::seq(&[single])]);
+    let alg = key.signature_algorithm(DigestAlg::Sha256);
+    let sig = key.sign(DigestAlg::Sha256, &tbs).unwrap();
+    let basic = match certs {
+        Some(c) => der::seq(&[&tbs, &alg, &der::bit_string(&sig), c]),
+        None => der::seq(&[&tbs, &alg, &der::bit_string(&sig)]),
+    };
+    let basic_type = der::oid("1.3.6.1.5.5.7.48.1.1");
+    der::seq(&[&der::tlv(tag::ENUMERATED, &[0]), &der::explicit(0, &der::seq(&[&basic_type, &der::octets(&basic)]))])
+}
+
+fn mid_june() -> Time {
+    Time { year: 2026, month: 6, day: 15, hour: 12, minute: 0, second: 0 }
+}
+
+#[test]
+fn crls_verify_and_report_revocation() {
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    let (this, next) = (mid_june(), Time { year: 2026, month: 7, day: 15, hour: 12, minute: 0, second: 0 });
+    let issuer = &id.certificate;
+    let at = mid_june();
+    // Not on the list: good.
+    let clean = CertificateList::parse(&crl(&id, None, this, next)).unwrap();
+    assert_eq!(clean.check(issuer, issuer, at), RevocationStatus::Good);
+    // On the list: revoked with its date.
+    let revoked =
+        CertificateList::parse(&crl(&id, Some((&issuer.serial, Time { year: 2026, month: 6, day: 1, hour: 8, minute: 0, second: 0 })), this, next))
+            .unwrap();
+    assert_eq!(
+        revoked.check(issuer, issuer, at),
+        RevocationStatus::Revoked { at: Time { year: 2026, month: 6, day: 1, hour: 8, minute: 0, second: 0 } }
+    );
+    // Outside the validity window: unknown.
+    let later = Time { year: 2026, month: 8, day: 1, hour: 0, minute: 0, second: 0 };
+    assert_eq!(clean.check(issuer, issuer, later), RevocationStatus::Unknown);
+    // A tampered CRL does not verify: unknown, never a false "good".
+    let mut tampered = crl(&id, None, this, next);
+    let t = tampered.windows(4).position(|w| w == &[0x6F, 0x6B, 0x00, 0x00][..]).unwrap_or(20);
+    tampered[t] ^= 0xFF;
+    assert_ne!(CertificateList::parse(&tampered).unwrap().check(issuer, issuer, at), RevocationStatus::Good);
+    // A different issuer's key does not verify it.
+    let other = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    assert_eq!(
+        CertificateList::parse(&crl(&id, None, this, next)).unwrap().check(&other.certificate, &other.certificate, at),
+        RevocationStatus::Unknown
+    );
+}
+
+/// `.p12` files that aren't clean DER still open — trailing
+/// whitespace, PEM armour or a bare base64 body — and real damage still fails,
+/// with the reason in the message.
+#[test]
+fn opens_wrapped_pkcs12_files_and_still_rejects_broken_ones() {
+    use base64::Engine as _;
+    let der = data("rsa-aes.p12");
+    let signer = pkcs12::open(&der, "test").unwrap();
+
+    // An editor or a download appends whitespace.
+    let mut trailing = der.clone();
+    trailing.extend_from_slice(b"\r\n \n");
+    assert_eq!(pkcs12::open(&trailing, "test").unwrap().certificate, signer.certificate);
+
+    // PEM armour, the way OpenSSL and government portals present them.
+    let b64 = base64::engine::general_purpose::STANDARD.encode(&der);
+    let mut pem = String::from("-----BEGIN PKCS12-----\n");
+    for line in b64.as_bytes().chunks(64) {
+        pem.push_str(std::str::from_utf8(line).unwrap());
+        pem.push('\n');
+    }
+    pem.push_str("-----END PKCS12-----\n");
+    assert_eq!(pkcs12::open(pem.as_bytes(), "test").unwrap().certificate, signer.certificate);
+
+    // The base64 body alone, armour stripped.
+    assert_eq!(pkcs12::open(b64.as_bytes(), "test").unwrap().certificate, signer.certificate);
+
+    // A truncated file still fails, and says why.
+    let err = pkcs12::open(&der[..64], "test").expect_err("truncated file");
+    assert!(err.to_string().contains("runs past the end"), "{err}");
+    let err = pkcs12::open(b"", "test").expect_err("empty file");
+    assert!(err.to_string().contains("truncated DER"), "{err}");
+}
+
+#[test]
+fn ocsp_responses_verify_and_match_the_certificate() {
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    let (this, next) = (mid_june(), Time { year: 2026, month: 7, day: 15, hour: 12, minute: 0, second: 0 });
+    let issuer = &id.certificate;
+    let at = mid_june();
+    let good = OcspResponse::parse(&ocsp(&id, RevocationStatus::Good, this, next)).unwrap();
+    assert_eq!(good.check(issuer, issuer, at), RevocationStatus::Good);
+    let revoked = OcspResponse::parse(&ocsp(
+        &id,
+        RevocationStatus::Revoked { at: Time { year: 2026, month: 6, day: 2, hour: 9, minute: 0, second: 0 } },
+        this,
+        next,
+    ))
+    .unwrap();
+    assert_eq!(
+        revoked.check(issuer, issuer, at),
+        RevocationStatus::Revoked { at: Time { year: 2026, month: 6, day: 2, hour: 9, minute: 0, second: 0 } }
+    );
+    // Outside the window: unknown.
+    let later = Time { year: 2026, month: 8, day: 1, hour: 0, minute: 0, second: 0 };
+    assert_eq!(good.check(issuer, issuer, later), RevocationStatus::Unknown);
+    // Signed by a different key than the named responder: unknown.
+    let other = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let wrong_key = OcspResponse::parse(&ocsp(&other, RevocationStatus::Good, this, next)).unwrap();
+    assert_eq!(wrong_key.check(issuer, issuer, at), RevocationStatus::Unknown);
+    // An error response is rejected at parse time.
+    let error = der::seq(&[&der::tlv(tag::ENUMERATED, &[6])]);
+    assert!(OcspResponse::parse(&error).is_err());
+    // responseStatus is an ENUMERATED (RFC 6960); an INTEGER is not one.
+    let error = der::seq(&[&der::int(6)]);
+    assert!(OcspResponse::parse(&error).is_err());
+}
+
+/// An embedded responder certificate answers for an issuer only when the issuer signed it for
+/// OCSP signing. One that merely copies the issuer's name, found by its key hash, does not.
+#[test]
+fn a_responder_that_copies_the_issuers_name_does_not_answer_for_it() {
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    let issuer = &id.certificate;
+    let (this, next) = (mid_june(), Time { year: 2026, month: 7, day: 15, hour: 12, minute: 0, second: 0 });
+    let key = craft_pkcs7::PrivateKey::generate_p256().unwrap();
+    let impostor =
+        Certificate::self_signed(&issuer.subject, &key, Time { year: 2026, month: 1, day: 1, hour: 0, minute: 0, second: 0 }, 5, &[9]).unwrap();
+    assert_eq!(impostor.subject.raw, issuer.subject.raw);
+    let cert_id = der::seq(&[
+        &DigestAlg::Sha1.algorithm(),
+        &der::octets(&DigestAlg::Sha1.digest(&[&issuer.issuer.raw])),
+        &der::octets(&DigestAlg::Sha1.digest(&[&issuer.public_key.key_bits()])),
+        &der::uint(&issuer.serial),
+    ]);
+    let revoked = der::tlv(tag::ctx(1), &Time { year: 2026, month: 6, day: 2, hour: 9, minute: 0, second: 0 }.encode());
+    let single = der::seq(&[&cert_id, &revoked, &this.encode(), &der::tlv(tag::ctx(0), &next.encode())]);
+    let by_key = der::tlv(tag::ctx(2), &der::octets(&DigestAlg::Sha1.digest(&[&impostor.public_key.key_bits()])));
+    // RFC 6960's `[0] EXPLICIT SEQUENCE OF Certificate`, and the certificate directly in `[0]`.
+    for certs in [der::explicit(0, &der::seq(&[&impostor.raw])), der::explicit(0, &impostor.raw)] {
+        let forged = OcspResponse::parse(&signed_ocsp(&key, &by_key, Some(&certs), &single, this)).unwrap();
+        assert_eq!(forged.check(issuer, issuer, mid_june()), RevocationStatus::Unknown);
+    }
+}
+
+// ── tolerance for the encodings found in old and unusual signers ───────────────────────────────
+// RSA signatures over SHA-256("hello") by the key in rsa-aes.p12, made with OpenSSL 3 (see
+// tests/data/README.md): the standard DigestInfo, DigestInfo without the NULL parameter, the bare
+// digest (which is refused: it does not say which hash algorithm it uses), and RSASSA-PSS with a
+// zero-length salt.
+const RSA_STD: &str = "40896f76bc460e4ae9dc523dfe136159c7ccc20eff09bfeeafd570fd41a6c016d6b2a1d771ba81642dd5bf94d2bb9c4aeead237ce0e1662678efd5ff7b8590bf7d5042f6541b001a9f7d688e60a9fde5c9b3f295bd5373aea1059b53f1341f30a4db68302161e95c6a62847205782edcd1fa99b6720eaa60b59d3f54d4ec7be396c8f1146fe35f198bd12dca608b8080a446f89ba300fd74f8df4e7f177c59dc48cf878451423dd9674df768a12f85a1b5e81a5b8df43ac0fb03c4393cfed7dceeeddf1c8aef9a37e738ff4169a6881e783c2f841fb974eb0e6ecedf649bf64fbc51920b7824d86b26527acaec5d0ebb44454606441fea2b7d7b7a6014ab9d64";
+const RSA_NO_NULL: &str = "a6589a056b04903cd77d5dae3b52f8c9905403ee2cef2e7343cfdd07746cbf1034c8c510a6f7258face9cfbcacb990e30f185dd091310d88efc3457e0fd34245d525e2cb5ceaab029e7b7fd25a581379c92e6abf90a36388cfc6afba0be47c99abc8b32e82a2c750ffe7c6d04de886cbfe63685cfc0f0204f641103e3c752496a0ae341fb503c4c2389824f7f20d07a03f0e3a95d5084fc1fb1b94c6bc607a14623b1bf7180b3d7d4592e217ba08698becb1994a6ef72ccab6e239418f11c57f184f59b0d1c7407216856cd4585da6a07354191ae85f8be02e670a10017f115ccb55d96f2ea2c1f095bbcf6b50ed8763945b78054989b016119c5371d918d682";
+const RSA_BARE: &str = "a5812c29d3edf0b567636aaa501a960b977e774a0ea941e41401611d8b63464e99e2e908d8d8452b97112597f06f2adee029109bf6e421eb57add689b518532232199151ed822d1766013ea44ae5cb468b4a2288cf866f8c5954b729bfd34a8ca82d73bb397a75eb76687f7d9e506dab32e2da6231ece307fe8eb929c7648f73de6dd81c38aecb78a0e7ef0e11654fbadef88c7b206079afee70db8054ada079c6456826383dfd2504f05033b58cf1610a180953e501e137b47de5a77914cfaa33b8c588f24dcdb5789e7d1288ff009918f6c2808bfa1c57398d2e007a5e6d3004a3ca568a4ae2eb5cfa14083099e81cfcb53ead9ec6650a7c58e441d117d439";
+const RSA_PSS_SALT0: &str = "2cdbb02d75a80df07dcca229363644caa4391cca30a3bc1281a3f4512dbe609727767c42e62cdad7d6bd38088b2c0b5dcb439fd2c337c31b47bbc39bda0e5c1486a773cde163fa2cad8047c06217541c993b21413e5cd341a4f66d2fb6e4755b52d25935dd90af667ce3d3e1825c8e6e40274dca7cf469ae17cbc3c1c1560d87a877a46353245128120beb1108cd0cafddae5b4ef9005601cc05f114da9de4cdaee08020d5b9be27e7b48f961e40664ef592990580bc1e1f2a8107c3d71d323df120720be6e862191a0aaa3b394b96efd2f45afa5f8211e2082865b8d3e3c28f99054976162ae8f42a903bfb82c17700db93fef603c4cd85c70a0be68fda9af8";
+
+fn unhex(s: &str) -> Vec<u8> {
+    (0..s.len()).step_by(2).map(|i| u8::from_str_radix(&s[i..i + 2], 16).unwrap()).collect()
+}
+
+#[test]
+fn rsa_signatures_are_read_with_every_digestinfo_variant() {
+    use craft_pkcs7::keys::{DigestAlg, PssParams, Scheme};
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    for (name, sig) in [("standard", RSA_STD), ("no NULL", RSA_NO_NULL)] {
+        assert!(key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &unhex(sig)).unwrap(), "{name}");
+    }
+    // Redundant leading zeros on the modulus change neither the result nor the arithmetic size.
+    if let craft_pkcs7::keys::PublicKey::Rsa { n, e } = key {
+        let pad = |v: &[u8]| [vec![0u8; 1 << 16], v.to_vec()].concat();
+        let padded = craft_pkcs7::keys::PublicKey::Rsa { n: pad(n), e: pad(e) };
+        assert!(padded.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &unhex(RSA_STD)).unwrap(), "padded key");
+    }
+    // The bare digest, with no DigestInfo, binds no hash algorithm: not a signature we accept.
+    assert!(!key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &unhex(RSA_BARE)).unwrap(), "bare digest");
+    // PSS with the salt length it declares, or any when none is declared.
+    let pss = |salt_len| Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len });
+    assert!(key.verify(pss(Some(0)), DigestAlg::Sha256, &digest, &unhex(RSA_PSS_SALT0)).unwrap());
+    assert!(key.verify(pss(None), DigestAlg::Sha256, &digest, &unhex(RSA_PSS_SALT0)).unwrap(), "salt length recovered");
+    assert!(!key.verify(pss(Some(32)), DigestAlg::Sha256, &digest, &unhex(RSA_PSS_SALT0)).unwrap(), "declared salt length is enforced");
+    // The check itself is not relaxed: another digest, a flipped bit, or the wrong scheme fail.
+    let other = DigestAlg::Sha256.digest(&[b"hellp"]);
+    let mut flipped = unhex(RSA_STD);
+    flipped[7] ^= 1;
+    for sig in [RSA_STD, RSA_NO_NULL, RSA_BARE] {
+        assert!(!key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &other, &unhex(sig)).unwrap());
+    }
+    assert!(!key.verify(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &flipped).unwrap());
+    assert!(!key.verify(pss(None), DigestAlg::Sha256, &digest, &unhex(RSA_STD)).unwrap());
+}
+
+#[test]
+fn ecdsa_signatures_are_read_as_der_non_minimal_der_or_raw() {
+    use craft_pkcs7::der::{self, Tlv};
+    use craft_pkcs7::keys::{DigestAlg, Scheme};
+    for (file, field) in [("ec-p256.p12", 32usize), ("ec-p384.p12", 48)] {
+        let id = pkcs12::open(&data(file), "test").unwrap();
+        let alg = id.key.preferred_digest();
+        let msg = b"signed content";
+        let digest = alg.digest(&[msg]);
+        let sig = id.key.sign(alg, msg).unwrap();
+        let pk = id.key.public_key();
+        assert!(pk.verify(Scheme::Ecdsa, alg, &digest, &sig).unwrap(), "{file}: DER");
+        let ints = Tlv::parse_all(&sig).unwrap().children().unwrap();
+        let fixed = |i: &Tlv<'_>| {
+            let m = i.uint_bytes();
+            let mut v = vec![0u8; field - m.len()];
+            v.extend_from_slice(m);
+            v
+        };
+        let (r, s) = (fixed(&ints[0]), fixed(&ints[1]));
+        // Raw r ‖ s (PKCS #11 tokens).
+        let raw = [r.clone(), s.clone()].concat();
+        assert!(pk.verify(Scheme::Ecdsa, alg, &digest, &raw).unwrap(), "{file}: raw");
+        // Integers padded with redundant leading zeros.
+        let padded = |v: &[u8]| der::tlv(0x02, &[&[0u8, 0][..], v].concat());
+        let loose = der::seq(&[&padded(&r), &padded(&s)]);
+        assert!(pk.verify(Scheme::Ecdsa, alg, &digest, &loose).unwrap(), "{file}: non-minimal DER");
+        // Still a real check.
+        let mut bad = raw.clone();
+        bad[3] ^= 0x40;
+        assert!(!pk.verify(Scheme::Ecdsa, alg, &digest, &bad).unwrap());
+        assert!(!pk.verify(Scheme::Ecdsa, alg, &DigestAlg::Sha256.digest(&[b"other"]), &raw).unwrap());
+        assert!(!pk.verify(Scheme::Ecdsa, alg, &digest, &[1, 2, 3]).unwrap());
+    }
+}
+
+#[test]
+fn tolerated_encodings_are_noted_and_standard_ones_are_not() {
+    use craft_pkcs7::der::{self, Tlv};
+    use craft_pkcs7::keys::{DigestAlg, Scheme};
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    let rsa_notes = |sig: &[u8]| {
+        let mut notes = Vec::new();
+        assert!(key.verify_noting(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, sig, &mut notes).unwrap());
+        notes
+    };
+    assert!(rsa_notes(&unhex(RSA_STD)).is_empty(), "a standard signature needs no excuse");
+    let no_null = rsa_notes(&unhex(RSA_NO_NULL));
+    assert!(matches!(no_null.as_slice(), [n] if n.contains("no NULL")), "{no_null:?}");
+    // A zero byte in front of the signature value: still the same signature, but not modulus-length.
+    let padded: Vec<u8> = std::iter::once(0).chain(unhex(RSA_STD)).collect();
+    let long = rsa_notes(&padded);
+    assert!(matches!(long.as_slice(), [n] if n.contains("modulus")), "{long:?}");
+
+    for (file, field) in [("ec-p256.p12", 32usize), ("ec-p384.p12", 48)] {
+        let id = pkcs12::open(&data(file), "test").unwrap();
+        let alg = id.key.preferred_digest();
+        let digest = alg.digest(&[b"signed content"]);
+        let sig = id.key.sign(alg, b"signed content").unwrap();
+        let pk = id.key.public_key();
+        let ec_notes = |sig: &[u8]| {
+            let mut notes = Vec::new();
+            assert!(pk.verify_noting(Scheme::Ecdsa, alg, &digest, sig, &mut notes).unwrap(), "{file}");
+            notes
+        };
+        assert!(ec_notes(&sig).is_empty(), "{file}: DER as made");
+        let ints = Tlv::parse_all(&sig).unwrap().children().unwrap();
+        let fixed = |i: &Tlv<'_>| {
+            let m = i.uint_bytes();
+            let mut v = vec![0u8; field - m.len()];
+            v.extend_from_slice(m);
+            v
+        };
+        let (r, s) = (fixed(&ints[0]), fixed(&ints[1]));
+        let raw = ec_notes(&[r.clone(), s.clone()].concat());
+        assert!(matches!(raw.as_slice(), [n] if n.contains("raw")), "{file}: {raw:?}");
+        let padded = |v: &[u8]| der::tlv(0x02, &[&[0u8, 0][..], v].concat());
+        let loose = ec_notes(&der::seq(&[&padded(&r), &padded(&s)]));
+        assert!(matches!(loose.as_slice(), [n] if n.contains("canonical DER")), "{file}: {loose:?}");
+    }
+}
+
+/// `a + b` for big-endian numbers of equal width, or `None` if the sum does not fit.
+fn add_be(a: &[u8], b: &[u8]) -> Option<Vec<u8>> {
+    let mut out = vec![0u8; a.len()];
+    let mut carry = 0u16;
+    for i in (0..a.len()).rev() {
+        let sum = u16::from(a[i]) + u16::from(b[i]) + carry;
+        out[i] = sum as u8;
+        carry = sum >> 8;
+    }
+    (carry == 0).then_some(out)
+}
+
+#[test]
+fn weak_digests_say_so_in_words_that_are_pinned() {
+    use craft_pkcs7::keys::DigestAlg;
+    // What the signature panel shows for a signature that still validates but should not be
+    // relied on. Strong digests get no note at all.
+    for alg in DigestAlg::ALL {
+        let note = alg.weakness();
+        match alg {
+            DigestAlg::Sha1 => assert_eq!(
+                note,
+                Some(
+                    "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on."
+                )
+            ),
+            DigestAlg::Ripemd160 => assert_eq!(
+                note,
+                Some(
+                    "This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on."
+                )
+            ),
+            _ => assert_eq!(note, None, "{}", alg.name()),
+        }
+    }
+}
+
+#[test]
+fn small_rsa_keys_say_so_and_others_do_not() {
+    let rsa = |n: Vec<u8>| PublicKey::Rsa { n, e: vec![1, 0, 1] };
+    let note = Some(
+        "This signature uses an RSA key shorter than 2048 bits, which is no longer considered strong enough for signatures. It still validates, but it should not be relied on.",
+    );
+    // 1024 bits, with and without the leading zero byte of a DER INTEGER.
+    assert_eq!(rsa(vec![0xC0; 128]).weakness(), note);
+    assert_eq!(rsa([vec![0], vec![0xC0; 128]].concat()).weakness(), note);
+    // 2047 bits is still short; 2048 bits and more are not.
+    assert_eq!(rsa([vec![0x7F], vec![0xFF; 255]].concat()).weakness(), note);
+    assert_eq!(rsa([vec![0, 0x80], vec![0; 255]].concat()).weakness(), None);
+    assert_eq!(rsa(vec![0xFF; 512]).weakness(), None);
+    assert_eq!(rsa(Vec::new()).weakness(), note, "an empty modulus is not a strong key");
+    // The key description counts the same bits, so it never says 2048 next to the warning.
+    assert_eq!(rsa([vec![0], vec![0xC0; 128]].concat()).describe(), "RSA 1024-bit");
+    assert_eq!(rsa([vec![0x7F], vec![0xFF; 255]].concat()).describe(), "RSA 2047-bit");
+    assert_eq!(rsa([vec![0, 0x80], vec![0; 255]].concat()).describe(), "RSA 2048-bit");
+    assert_eq!(PublicKey::P256(vec![4; 65]).weakness(), None);
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    assert_eq!(id.certificate.public_key.weakness(), None, "the 2048-bit test identity");
+}
+
+/// A synthetic 1024-bit key made for this test (`openssl genrsa 1024`, e = 65537) and its
+/// PKCS #1 v1.5 SHA-256 signature of `hello`.
+const RSA_1024_N: &str = "ae561814194f0a06475c002fc7633b81e83a738ad3f35ba1ded959be6f6b62302028d58707403f44b7bda959e446f13849896711985ac4815e58d7d323aee664771c35bf2dc3db1bcdc49ac61ae7282a24ec7a5af9f6ebe98945e6a71c4998ed31c41bbb997c4873fb4b8271fd3cf76648efcbff76972ab7bcaf831b9e203d47";
+const RSA_1024_SIG: &str = "0de5110137e768a6b00201cf8340688c81a901fe309489f2c8186b7dc56e67f7e64188970a9bea926b9bd99b19985adfb0489956ffd5e0264468b678c4fd49a155a895fcb9ab127d0c3742b7a07866b3deec20a5b2f61af4cbfd2901517dc268e4d6edf4e905e0f4e05cdc740c3180971c1ec1470c1476f90ea988e2ab4cbb18";
+
+#[test]
+fn a_signature_made_with_a_small_rsa_key_verifies_with_the_note() {
+    use craft_pkcs7::keys::Scheme;
+    let key = PublicKey::Rsa { n: unhex(RSA_1024_N), e: vec![1, 0, 1] };
+    let weak = key.weakness().expect("a 1024-bit key is short");
+    let sig = unhex(RSA_1024_SIG);
+    let mut notes = Vec::new();
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    assert!(key.verify_noting(Scheme::RsaPkcs1, DigestAlg::Sha256, &digest, &sig, &mut notes).unwrap());
+    assert_eq!(notes, [weak]);
+    // A signature that doesn't verify says nothing about the key.
+    let mut notes = Vec::new();
+    let other = DigestAlg::Sha256.digest(&[b"hullo"]);
+    assert!(!key.verify_noting(Scheme::RsaPkcs1, DigestAlg::Sha256, &other, &sig, &mut notes).unwrap());
+    assert!(!notes.contains(&weak), "{notes:?}");
+}
+
+#[test]
+fn an_rsa_signature_value_not_below_the_modulus_is_refused() {
+    use craft_pkcs7::keys::{DigestAlg, PssParams, Scheme};
+    // RFC 8017 §5.2.2 (RSAVP1): a signature representative s must be below n. Otherwise s and
+    // s + n are the same number modulo n and both would verify (malleability, not forgery).
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let PublicKey::Rsa { n, .. } = key else { panic!("an RSA key") };
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    let pss = Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len: Some(0) });
+    let sig = unhex(RSA_PSS_SALT0);
+    assert!(key.verify(pss, DigestAlg::Sha256, &digest, &sig).unwrap(), "the signature as made");
+    let alias = add_be(&sig, n).expect("this signature plus the modulus still has the modulus' length");
+    assert_eq!(alias.len(), n.len());
+    assert!(!key.verify(pss, DigestAlg::Sha256, &digest, &alias).unwrap(), "s + n is not the signature");
+}
+
+#[test]
+fn hostile_rsa_signature_values_are_wrong_not_crashes() {
+    use craft_pkcs7::keys::{DigestAlg, PssParams, Scheme};
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let key = &id.certificate.public_key;
+    let PublicKey::Rsa { n, .. } = key else { panic!("an RSA key") };
+    let digest = DigestAlg::Sha256.digest(&[b"hello"]);
+    let pss = Scheme::RsaPss(PssParams { mgf: DigestAlg::Sha256, salt_len: Some(32) });
+    let mut one_more = vec![1u8];
+    one_more.extend(vec![0u8; n.len()]);
+    for sig in [vec![], vec![0], vec![0; n.len()], vec![0xFF; n.len()], vec![0xFF; n.len() + 40], n.clone(), one_more] {
+        for scheme in [Scheme::RsaPkcs1, pss] {
+            assert!(!key.verify(scheme, DigestAlg::Sha256, &digest, &sig).unwrap(), "{} bytes", sig.len());
+        }
+    }
+    // A digest of the wrong length for PSS is a mismatch, not a crash either.
+    assert!(!key.verify(pss, DigestAlg::Sha256, &[1, 2, 3], &unhex(RSA_STD)).unwrap());
+}
+
+#[test]
+fn keys_of_unknown_algorithms_are_unsupported_not_wrong() {
+    use craft_pkcs7::der::{self, Tlv};
+    use craft_pkcs7::keys::{DigestAlg, Scheme};
+    // An Ed448 key (1.3.101.113), which isn't supported: the key parses, checking says "can't".
+    let spki = der::seq(&[&der::seq(&[&der::oid("1.3.101.113")]), &der::bit_string(&[7u8; 57])]);
+    let key = PublicKey::from_spki(&Tlv::parse_all(&spki).unwrap()).unwrap();
+    assert_eq!(key.spki(), spki);
+    assert!(key.describe().contains("unsupported"));
+    let r = key.verify(Scheme::Ecdsa, DigestAlg::Sha256, &[0; 32], &[0; 64]);
+    assert!(matches!(r, Err(Error::Unsupported(_))), "{r:?}");
+    // An unknown curve likewise.
+    let spki = der::seq(&[&der::seq(&[&der::oid("1.2.840.10045.2.1"), &der::oid("1.3.132.0.10")]), &der::bit_string(&[4u8; 65])]);
+    let key = PublicKey::from_spki(&Tlv::parse_all(&spki).unwrap()).unwrap();
+    assert!(matches!(key.verify(Scheme::Ecdsa, DigestAlg::Sha256, &[0; 32], &[0; 64]), Err(Error::Unsupported(_))));
+}
+
+// ECDSA signatures by OpenSSL 3 over a digest of "hello": (SubjectPublicKeyInfo, digest, DER signature).
+const P521: (&str, &str, &str) = (
+    "30819b301006072a8648ce3d020106052b8104002303818600040079586325f44d28973f270dcb9595a6309b93c3898eedb901b08873694c690265e61c1cbf5b1a339cacdcfe3ece7e00744bf6ed158d663209c8acf378ddda2e824100b1386a84a2efa8d4f78b6cf7018e58fac5bb9a57f33b3ef584649ba57910a163ba026245ad9e1b93597b5db1f05431267b3953c205312d0c8bf0d910eef237f438",
+    "9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043",
+    "30818802420156bae253f050fc9202661280cbb8b1eedb8d4767aee63afdd130d376f50a18097902d0c6bd17eb8e4b4383f355751f3578e06850d5f3dfd8a86f3085e7100535b4024201f92f6f722290652195edf7b3168a91425a4e8a70386e06af6bceafd8a5f26dc19e5c13e7566e789d9459433e911e439819fdc350ea8ab1df6421257eaa55e23cf8",
+);
+const BP256: (&str, &str, &str) = (
+    "305a301406072a8648ce3d020106092b2403030208010107034200049ba05e64295ad9b86295d9cfa717a2549474e83abb2825be32a0fae5297b07344f9e9018cf394001f98d634680b1e20be49f6118c726fdad4b11ccae99b95358",
+    "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
+    "304402203815740bcccfdec285f1e168f28b4529bb39eba2683085260653c7a53dd2e69e022048ba910ce1f9141d8213fa1804a3d548271e0b9c307f6b26c80951be7e7a59a2",
+);
+const BP384: (&str, &str, &str) = (
+    "307a301406072a8648ce3d020106092b240303020801010b03620004874bc125ea23dd5553b1e5440c5cb064032f9a6cbdea271745232ade525b082951d0b251a45b2af74d3325dbe7872f9635b6223c6b2cd4d7f24a50fd9058f946a154919adb24e268975df951e561884b14f899bc87af0820c50f3b706b7acb4c",
+    "59e1748777448c69de6b800d7a33bbfb9ff1b463e44354c3553bcdb9c666fa90125a3c79f90397bdf5f6a13de828684f",
+    "30640230284776ae1458b137bfe0f1628193983ae8bd5d58d84957fb215da42c5ba0e48400aaba4960b6e0a23aa8d7c20084cbba02301000b700ae6d946ad032f7a08e64c565bb6227e722edd2813dcbc5dfa79d099cf93ea8d48b4293869942a4f68671a915",
+);
+
+#[test]
+fn verifies_ecdsa_on_p521_and_the_brainpool_curves() {
+    use craft_pkcs7::der::Tlv;
+    use craft_pkcs7::keys::{DigestAlg, Scheme};
+    for (name, (spki, digest, sig), alg, describe) in [
+        ("P-521", P521, DigestAlg::Sha512, "ECDSA P-521"),
+        ("brainpoolP256r1", BP256, DigestAlg::Sha256, "ECDSA brainpoolP256r1"),
+        ("brainpoolP384r1", BP384, DigestAlg::Sha384, "ECDSA brainpoolP384r1"),
+    ] {
+        let spki = unhex(spki);
+        let key = PublicKey::from_spki(&Tlv::parse_all(&spki).unwrap()).unwrap();
+        assert_eq!(key.describe(), describe);
+        assert_eq!(key.spki(), spki, "{name}: re-encodes");
+        let (digest, sig) = (unhex(digest), unhex(sig));
+        assert!(key.verify(Scheme::Ecdsa, alg, &digest, &sig).unwrap(), "{name}");
+        let mut bad = digest.clone();
+        bad[0] ^= 1;
+        assert!(!key.verify(Scheme::Ecdsa, alg, &bad, &sig).unwrap(), "{name}: other digest");
+        // The digest named by the algorithm identifier may be shorter than the curve (SHA-256 on
+        // P-521 etc.): that is a different digest, so it must not verify this signature.
+        assert!(!key.verify(Scheme::Ecdsa, alg, &digest[..digest.len() / 2], &sig).unwrap(), "{name}: short digest");
+    }
+}
diff --git a/crates/pkcs7/tests/it/main.rs b/crates/pkcs7/tests/it/main.rs
new file mode 100644
index 000000000..4a10ec793
--- /dev/null
+++ b/crates/pkcs7/tests/it/main.rs
@@ -0,0 +1,8 @@
+//! The crate's integration tests, linked into one test binary.
+
+mod algorithms;
+mod ber;
+mod chain;
+mod cms;
+mod crypto;
+mod store_keys;
diff --git a/crates/pkcs7/tests/it/store_keys.rs b/crates/pkcs7/tests/it/store_keys.rs
new file mode 100644
index 000000000..a84ecdd6a
--- /dev/null
+++ b/crates/pkcs7/tests/it/store_keys.rs
@@ -0,0 +1,89 @@
+//! What the Windows certificate store (`src/windows.rs`, built only on Windows) may sign with,
+//! checked on every platform: which certificate keys it lists, and how a CNG signature becomes
+//! the one a CMS signature carries.
+
+use craft_pkcs7::keys::{DigestAlg, Scheme, StoreKey};
+use craft_pkcs7::{Error, PublicKey};
+use p256::ecdsa::signature::hazmat::PrehashSigner;
+
+/// One key of every kind, with what the store must hold to sign for it.
+fn every_kind() -> Vec<(PublicKey, Option<StoreKey>)> {
+    let point = vec![4u8; 65];
+    let keys = vec![
+        (PublicKey::Rsa { n: vec![0xc5; 256], e: vec![1, 0, 1] }, Some(StoreKey::Rsa)),
+        (PublicKey::P256(point.clone()), Some(StoreKey::Ecdsa(256))),
+        (PublicKey::P384(point.clone()), Some(StoreKey::Ecdsa(384))),
+        (PublicKey::P521(point.clone()), None),
+        (PublicKey::BrainpoolP256(point.clone()), None),
+        (PublicKey::BrainpoolP384(point.clone()), None),
+        (PublicKey::BrainpoolP512(point.clone()), None),
+        (PublicKey::Ed25519(vec![7; 32]), None),
+        (PublicKey::Unsupported { what: "elliptic curve 1.3.132.0.10".into(), spki: Vec::new() }, None),
+    ];
+    // Every variant is named, with no `_` arm: a new one stops this test compiling until it is
+    // listed above with the answer the store should give.
+    for (key, _) in &keys {
+        match key {
+            PublicKey::Rsa { .. }
+            | PublicKey::P256(_)
+            | PublicKey::P384(_)
+            | PublicKey::P521(_)
+            | PublicKey::BrainpoolP256(_)
+            | PublicKey::BrainpoolP384(_)
+            | PublicKey::BrainpoolP512(_)
+            | PublicKey::Ed25519(_)
+            | PublicKey::Unsupported { .. } => {}
+        }
+    }
+    keys
+}
+
+#[test]
+fn the_store_signs_only_with_rsa_p256_and_p384() {
+    for (key, want) in every_kind() {
+        assert_eq!(key.store_signing_key(), want, "{}", key.describe());
+        if want.is_none() {
+            // Skipped when listing, and refused (not a panic) if one ever reached signing.
+            let refused = key.store_signature_der(&[0; 64]);
+            assert!(matches!(refused, Err(Error::Unsupported(_))), "{}: {refused:?}", key.describe());
+        }
+    }
+}
+
+#[test]
+fn cng_signatures_become_cms_signatures_that_verify() {
+    let msg = b"hello";
+
+    let k = p256::ecdsa::SigningKey::from_slice(&[0x11; 32]).unwrap();
+    let public = PublicKey::P256(k.verifying_key().to_sec1_point(false).as_bytes().to_vec());
+    let digest = DigestAlg::Sha256.digest(&[msg]);
+    let s: p256::ecdsa::Signature = k.sign_prehash(&digest).unwrap();
+    // CNG returns r ‖ s, 32 bytes each for P-256.
+    let der = public.store_signature_der(&s.to_bytes()).unwrap();
+    assert_eq!(der.first(), Some(&0x30), "a DER SEQUENCE");
+    assert!(public.verify(Scheme::Ecdsa, DigestAlg::Sha256, &digest, &der).unwrap());
+
+    let k = p384::ecdsa::SigningKey::from_slice(&[0x22; 48]).unwrap();
+    let public = PublicKey::P384(k.verifying_key().to_sec1_point(false).as_bytes().to_vec());
+    let digest = DigestAlg::Sha384.digest(&[msg]);
+    let s: p384::ecdsa::Signature = k.sign_prehash(&digest).unwrap();
+    let der = public.store_signature_der(&s.to_bytes()).unwrap();
+    assert!(public.verify(Scheme::Ecdsa, DigestAlg::Sha384, &digest, &der).unwrap());
+
+    // RSA PKCS #1 v1.5 signatures are already what CMS carries.
+    let rsa = PublicKey::Rsa { n: vec![0xc5; 256], e: vec![1, 0, 1] };
+    assert_eq!(rsa.store_signature_der(&[9; 256]).unwrap(), vec![9; 256]);
+}
+
+#[test]
+fn a_malformed_cng_signature_is_an_error() {
+    // Wrong lengths, and right lengths whose r and s are zero or not below the group order.
+    let p256: [&[u8]; 5] = [&[], &[1; 63], &[1; 65], &[0; 64], &[0xff; 64]];
+    let p384: [&[u8]; 5] = [&[], &[1; 95], &[1; 97], &[0; 96], &[0xff; 96]];
+    for (key, bad) in [(PublicKey::P256(Vec::new()), p256), (PublicKey::P384(Vec::new()), p384)] {
+        for raw in bad {
+            let got = key.store_signature_der(raw);
+            assert!(matches!(got, Err(Error::Crypto(_))), "{}, {} bytes: {got:?}", key.describe(), raw.len());
+        }
+    }
+}