Digest comparison detects a changed record: passed
Inclusion proof accepts the record only at its position: passed
Signature verifies only for the signed manifest and key: passed
Signature rejects a root rebuilt from a changed record: passed
