Function verify_detached 

pub fn verify_detached(
    catalog_bytes: &[u8],
    sig: &SignatureDoc,
    keyset: &Keyset,
    expires_at: Option<DateTime<Utc>>,
    now: DateTime<Utc>,
) -> Verification

Verify a detached Ed25519 signature over the exact catalog bytes. Fail-closed: any problem returns verified=false with a reason; the caller drops an unverified remote source’s entries.