Pragmatic-persona observation from #303 (pre-existing behavior, not introduced there). vault_export.rs verifies each Ed25519 signature locally, but a failed verification only logs an error and the signature is still submitted. The KMS backend added in #303 hard-fails instead, which is correct: a signature that fails local verification is guaranteed to be rejected at ExecuteSubmission. Align the export path with that behavior.
Pragmatic-persona observation from #303 (pre-existing behavior, not introduced there).
vault_export.rsverifies each Ed25519 signature locally, but a failed verification only logs an error and the signature is still submitted. The KMS backend added in #303 hard-fails instead, which is correct: a signature that fails local verification is guaranteed to be rejected at ExecuteSubmission. Align the export path with that behavior.