pub fn delegation_sign_bytes(cert: &DelegationCert) -> Vec<u8> ⓘExpand description
Canonical bytes signed to produce DelegationCert.signature.
constraints is always serialized — as [] when empty — so canonical
bytes are deterministic across issuers and cross-SDK.
Keys in lex order: cert_id, constraints, expires_at, issued_at, issuer_id,
issuer_pub_key, scope, subject_id, subject_pub_key, version.