Schema, canonicalization, payload hash linkage, JWS/JWKS verification, claim-basis policy, and trust-lineage checks for vSB bundles.
—