Function verify_note 

pub fn verify_note(
    note_bytes: &[u8],
    verifier: &NoteVerifierKey,
) -> TrustResult<String>

Parses and verifies an untrusted note; returns the verified body text (including its trailing newline).

Mirrors Go note.Open: total-size cap, UTF-8 with no ASCII control characters below 0x20 except '\n', split at the last "\n\n", every signature line structurally valid (any malformed line rejects the whole note), at most 100 signature lines. The FIRST signature line matching the verifier’s (name, key ID) decides the whole note: strict Ed25519 verification over the body bytes accepts on success and rejects the note on failure — later matching lines are never consulted. This is exactly Go’s behavior (duplicate signatures by one signer are skipped after the first, and a failed known-key signature is a hard InvalidSignatureError) and the C2SP signed-note rule that a failed signature from a known key rejects the whole note.

Errors

Returns TrustError::NoteVerification on every failure mode — size, UTF-8, structure, no candidate, bad signature — with no distinguishing detail (non-oracle).