They also verified the cryptographic signature. The signing key existed in the package but lacked a known root; a quick call to the vendor confirmed they’d rotated CAs last quarter. The vendor provided a chain and a short advisory noting the change, buried in a forum thread.