CI's Windows runner checks out with core.autocrlf=true, which rewrote the signed openssl-signed.pdf fixture and made validates_a_signature_made_by_openssl report Invalid there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>