• Pure signature check — no chain access. Verifies the embedded signature against the Demos public key encoded in cciPrimaryClaim.

    Returns false (not throws) on any structural problem so callers can use it as a filter when iterating SP candidates in resolveMember.

    Parameters

    Returns boolean