# seal.123 — provider signing certificates, SHA-256 fingerprints of the cert DER.
# Check a sealed PDF's signer cert: openssl x509 -in signer.pem -outform DER | sha256sum
# Append-only across rotations; a fingerprint is removed only on key compromise.
22668f2420927ab6b31cea910622a1eccdd4bc791101e07c390812f7220e3be2
767e46347450cfa095615021086290a20e76236978468d05c3d5713aa60b25ba