Function matches_digest 

pub fn matches_digest<'a, P: Digest<'a>, W: Work>(
    provider: &P,
    digest: Finished<'_, P, P::Identity, P::Output>,
    expected: &[u8],
    execution: &W,
    field: &'static str,
    span: Span,
) -> Result<DigestBinding, BindError<P::Error>>

Checks actual output width before comparing a declared digest.

This applies even when the identity has no fixed width. field/span identify the original declaration, not the output or a synthesized DER element. Provider instance identity is checked before work or callback. The borrowed provider retained by the finished output cannot be replaced or moved while in use. The provider’s matches receives its own finished output; no resolver, hashing or copy is performed.