From review. When undo restores security from before the last save,
save_bytes now appends the snapshot to its own source instead of
writing it in full. That source has the snapshot's encryption and none
of the revisions being undone, so the save keeps its revisions, object
numbers and signatures; saves made after it are dropped, since undo
went back past them. A snapshot with no edits of its own is saved as
its source's bytes unchanged. Deleting a signed field lets security
change before an undo back to the signed state; that state now saves
as the signed file itself instead of being refused.
The output-security comparison drops file_key(): the dictionary and,
below revision 5, the first /ID determine the key.
skylar taylor-barrick
7ebd6eabe1