Function verify_self_contained

atomic-canonical/src/delegation.rs:256–260

Verify a certificate using the delegator key the document itself carries. This checks **integrity**, not trust: it proves the document was signed by whoever holds the key it names and has not been altered since. It cannot tell you that key belongs to the person you think — that is settled by comparing the recovered DID against a key you already trust (the server's registered identity, or a `deleg

(document: &Value)

/// agent's key, or rendering an unfamiliar certificate before deciding what to
/// do with it. Where the delegator's key *is* available, prefer [`verify`].
pub fn verify_self_contained(document: &Value) -> Result<Delegation> {
    let parsed = parse(document)?;
    let key = delegator_public_key(&parsed)?;
    verify(document, &key)
}

// ---------------------------------------------------------------------------
// Transport