ExplainsRefusal

A verifier that can say WHY a signature established nobody — after the gate has already refused. Kept apart from {@see SignatureVerifier} so that port's rule stands untouched: `verify()` is the only answer a gate reads, and it is null for every refusal. This one returns words for a person, never a signer, so there is no softer «no» a caller could decide to proceed on (greenhouse evidence/1071, B9).

abstract public function whyNot(string $payload, string $signature): ?Milpa\ToolRuntime\Identity\SignatureRefusal

The refusal, named — or null when the signature does establish a signer.

Parameters