The first evidence this project admits that somebody other than us signed. EC2 exposes a JSON instance identity document and a detached PKCS#7/RSA-2048 signature over it via IMDSv2; this backend checks that signature against regional AWS certificates configured by the deployment, and refuses a tampered document, a signature from the wrong key, or one already spent. The format carries no audience and no expiry, so admission is bound to the seen-nonce store instead, keyed on the document's instanceId and pendingTime (never a renameable tag). node_id is never trusted from the wire claim alone: attest_at re-derives it from the verified document and refuses a mismatch, so a spoofed envelope cannot borrow a genuine signature's admission. A stale pendingTime is refused through the same Stale error the previous commit sharpened, and admission records ExecutionEnvironment::CloudInstance. No CMS/PKCS#7 crate in the registry is compatible with the der 0.7 line already in this workspace's dependency graph without doubling it (cms exists only as 0.3.0-pre.2, and pulls der 0.8) — see the workspace Cargo.toml's note on jacquard for why that duplication is a real hazard here. So SignedData parsing is hand-rolled against der/spki/x509-cert/rsa, all pinned to versions already resolved elsewhere in the tree, verified by `cargo tree` to add no second copy of der, spki, const-oid, pkcs8 or sha2. Tested against a real AWS RSA-2048 certificate for us-east-1 (published in AWS's docs) for certificate loading, and against a full attest_at round trip signed with a locally generated key for the signature-verification path itself, since AWS does not publish a matching (document, signature) pair — only certificates. The true end-to-end path can only be exercised from a running EC2 instance. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Change-Id: Ie494e6cc2f9b983e6a704fdbafc66b1df4bac4d5