pub fn classify_subagent_spawn(
trust: &RoleTrustSet<SubagentRole>,
spawn: &SubagentSpawn,
) -> SignatureVerdictExpand description
Classifies the provenance signature on spawn against trust.
The verdict is SignatureVerdict::Verified only when the signature
checks out against the embedded signed_by key AND trust holds that key
for the sub-agent role. A good signature from a key outside trust reads
as SignatureVerdict::Untrusted. Bad hex, a bad signature, and a
malformed key all read as SignatureVerdict::Invalid. The function never
panics.