Function check_signed_at 

pub fn check_signed_at(
    signed_at: DateTime<Utc>,
    freshness_window_secs: u32,
    now: DateTime<Utc>,
) -> FreshnessCheck

Pure freshness check: compare signed_at against now, allowing the channel’s freshness_window_secs plus CLOCK_SKEW_SLACK_SECS. Returns Fresh if the manifest is within the window (inclusive at the boundary), Stale past it.

Negative ages (signer’s clock ahead of agent’s) are always Fresh — the limit comparison is age > limit, so age=−30 < limit always.