Function matches_digest 

pub fn matches_digest<'a, P: DigestProvider<'a>, W: Work>(
    provider: &P,
    digest: Prehash<'_, '_, P, P::Identity>,
    expected: &[u8],
    execution: &W,
    field: &'static str,
    span: Span,
) -> Result<DigestBinding, BindError<P::Error>>

Checks actual output width before comparing a declared digest.

This applies even when digest_width is None. field/span identify the original declaration, not the output or a synthesized DER element. Provider instance identity is checked before work or callback. The borrowed provider retained by the finalized output cannot be replaced or moved while in use. The callback receives bytes already finalized; no resolver, hashing or copy is performed.