Read the scope before the signature.

What did the certificate establish?

Start with the exact subject revision, configuration and rule versions. Read the method, explored cases, budget, assumptions and exclusions. No violation seen in the cases tried says nothing about the cases not tried.

A useful certificate can report a failure or an incomplete result. Check whether each rule was exercised and whether the evidence supports the claimed outcome. Distinguish an attempted action from a confirmed external effect.

What is protected?

A digest identifies bytes. A signature can authenticate a message under a key. A retained anchor can tie a portion of a ledger to a checkpoint you trust. None of these makes the underlying observation true, or shows that every action was recorded.

The existing evidence-pack verifier checks ledger integrity relative to retained anchors. It ignores derived action and coverage summaries. A certificate manifest needs its own supported protection profile; a pretty rendering is not automatically signed because it sits beside a ledger.

Does it still apply?

Check the subject, policy, configuration and assumptions against the system you are considering. Look for later fixes, rechecks, invalidations, withdrawals and key-status records.

Offline verification can establish historical integrity under its supplied inputs. Without a fresh trusted status snapshot, current applicability or non-revocation may remain unknown. Keep the snapshot date and age with your decision.