Check a retained report against its signature

Recomputes the identifier and checks the signature over a compliance report you kept. Keyless and unmetered — a grantor confirming a filed document should not spend a screen doing it, and their auditor should not need a credential at all.

Reports also state report_format, which versions what the document ASSERTS: which limitations apply, which section governs a conflict, what the summary concludes. An older format is not wrong, but today's may describe the same organization differently, and the response says which you are holding.

Offline verification is equivalent and needs nothing from us: the Ed25519 public key is published on /meta. Note this is a detached signature over the report data, not an X.509/PAdES PDF signature — a PDF reader shows no signature panel.