Function verify_capability 

pub fn verify_capability(
    token: &CapabilityToken,
    trusted_issuers: &[PublicKey],
    clock: &dyn Clock,
) -> Result<VerifiedCapability, CapabilityError>

Verify the signature, issuer trust, and time-bounds of a capability token.

Returns a VerifiedCapability when all three checks succeed. Delegation chain validation, revocation lookup, and subject-binding checks are the caller’s responsibility (see module docs).