flowchart TB
  in["Archive, detached signature<br/>and signer certificate"]
  t1{"Step 1: chain, then identity<br/>openssl verify, then SAN compared exactly"}
  r1["Rejected<br/>self-issued certificate<br/>or other identity"]:::danger
  t2{"Step 2: openssl dgst -verify<br/>signature over the bytes"}
  r2["Rejected<br/>altered bytes<br/>or other key"]:::danger
  ok["Archive accepted"]:::accent
  in --> t1
  t1 -->|rejected| r1
  t1 -->|accepted| t2
  t2 -->|invalid| r2
  t2 -->|valid| ok