Function verify_signed_data 

pub fn verify_signed_data<F>(
    signed_data: &SignedData,
    payload: &[u8],
    verifier: F,
) -> Result<CmsVerificationResult, CmsError>
where
    F: Fn(usize, &[u8], &[u8], &[u8]) -> Result<(), String>,

Verify a SignedData structure. The verifier callback receives (signer_index, public_key_der, signed_data_to_verify, signature_bytes) and returns Ok(()) if valid.

Each signer is resolved to its certificate by resolve_signer_certificate. If no cert matches, that signer is reported as failed (not skipped). The signed bytes are computed per RFC 5652:

• If signer_info.signed_attrs is non-empty, the signed bytes are the canonical DER re-encoding of those attributes (so that a malicious encoder can’t swap one canonical form for another).
• Otherwise the signed bytes are the encapsulated content (or the payload argument if the content is detached).