pub const kSecCSStrictValidate: SecCSFlags = 1 << 4; // 0x0000_0010u32