20260711 验证TAL信任锚自签名

src/data_model/ta.rs

@@ -244,6 +244,9 @@ pub enum TrustAnchorError {
     #[error("TA certificate error: {0} (RFC 8630 §2.3)")]
     TaCertificate(#[from] TaCertificateDecodeError),
 
+    #[error("TA certificate self-signature error: {0} (RFC 8630 §2.3)")]
+    TaSelfSignature(#[from] TaCertificateVerifyError),
+
     #[error("{0}")]
     Bind(#[from] TrustAnchorBindError),
 }
@@ -269,6 +272,7 @@ impl TrustAnchor {
         resolved_uri: Option<&Url>,
     ) -> Result<Self, TrustAnchorError> {
         let ta_certificate = TaCertificate::decode_der(ta_der)?;
+        ta_certificate.verify_self_signature()?;
         Ok(Self::bind(tal, ta_certificate, resolved_uri)?)
     }
 
@@ -278,6 +282,7 @@ impl TrustAnchor {
         resolved_uri: Option<&Url>,
     ) -> Result<Self, TrustAnchorError> {
         let ta_certificate = TaCertificate::decode_der_with_strict_name(ta_der)?;
+        ta_certificate.verify_self_signature()?;
         Ok(Self::bind(tal, ta_certificate, resolved_uri)?)
     }