20260510 增加strict策略模式并隔离多TA失败

src/data_model/ta.rs

@@ -112,6 +112,14 @@ impl TaCertificate {
         Ok(Self::parse_der(der)?.validate_profile()?)
     }
 
+    pub fn decode_der_with_strict_name(der: &[u8]) -> Result<Self, TaCertificateDecodeError> {
+        let ta = Self::decode_der(der)?;
+        ta.rc_ca
+            .validate_strict_name_profile()
+            .map_err(TaCertificateProfileError::from)?;
+        Ok(ta)
+    }
+
     /// Backwards-compatible helper (historical name).
     pub fn from_der(der: &[u8]) -> Result<Self, TaCertificateError> {
         Self::decode_der(der)
@@ -264,6 +272,15 @@ impl TrustAnchor {
         Ok(Self::bind(tal, ta_certificate, resolved_uri)?)
     }
 
+    pub fn bind_der_with_strict_name(
+        tal: Tal,
+        ta_der: &[u8],
+        resolved_uri: Option<&Url>,
+    ) -> Result<Self, TrustAnchorError> {
+        let ta_certificate = TaCertificate::decode_der_with_strict_name(ta_der)?;
+        Ok(Self::bind(tal, ta_certificate, resolved_uri)?)
+    }
+
     pub fn bind(
         tal: Tal,
         ta_certificate: TaCertificate,