Module path 

Hierarchical path validation with scope enforcement.

Validates a certificate chain from leaf to trusted root. Enforces:

• Time validity at each link
• Signature validity (when verifier is provided)
• Basic constraints (path length, CA flag)
• Confium-specific scope constraints (delegation rules)

Structs

CertPath

A certificate path: leaf + intermediates + root.

Functions

validate_path

Validate the structural and time-bounds aspects of a path. Does NOT verify signatures — that requires algorithm-specific verifiers and is done in verify_path_signatures.

verify_path_signatures

Hook for signature verification — caller provides a verifier function. The verifier receives (parent_pubkey, signed_cert_der) and returns Ok(()) if the signature is valid.