Function trusted_root_from_bundle 

pub fn trusted_root_from_bundle(
    bundle: &IdentityBundle,
    now: DateTime<Utc>,
) -> Result<String, CommitTrustError>

The trusted root did:keri: a CI/stateless identity bundle pins.

The bundle’s identity_did is a self-certifying KERI prefix (the prefix is the digest of its inception event), so trusting it as a pinned root is sound: any KEL resolved for that DID must self-certify to the same prefix or fail prefix-binding. The bundle is freshness-checked against now and fails closed — a stale or malformed anchor is rejected, never silently treated as “no constraint”.

Args:

• bundle: The parsed identity bundle supplied via --identity-bundle.
• now: Current time, injected at the presentation boundary.

Usage:

let root = trusted_root_from_bundle(&bundle, clock.now())?;
pinned_roots.push(root);