Clean-room check (zero CAIN imports):

    python3 verify_e35.py E35_SAMPLE_CAIO.json $(cat E35_SAMPLE_ISSUER_PUB.txt) 1000000 7
      -> verify OK, decision VALID
    python3 verify_e35.py E35_SAMPLE_CAIO_TAMPERED.json $(cat E35_SAMPLE_ISSUER_PUB.txt) 1000000 7
      -> decision INVALID (exit 1)

Keys are generated per build; only the public key is published.