bundle

type Root struct {
	// Certificate is the DER-encoded certificate (read-only; do not modify!).
	Certificate []byte

	// Constraint is nil if the root is unconstrained. If Constraint is non-nil,
	// the certificate has additional constraints that cannot be encoded in
	// X.509, and when building a certificate chain anchored with this root the
	// chain should be passed to this function to check its validity. If using a
	// [crypto/x509.CertPool] the root should be added using
	// [crypto/x509.CertPool.AddCertWithConstraint].
	Constraint func([]*x509.Certificate) error
}