pub fn fingerprint(bytes: &[u8]) -> [u8; 32]
Compute the SHA-256 fingerprint of a byte slice. Used as the leaf hash for cert entries.