Function verify_rollout_manifest 

pub fn verify_rollout_manifest(
    signed_bytes: &[u8],
    signature: &[u8],
    trusted_keys: &[TrustedPubkey],
    now: DateTime<Utc>,
    freshness_window: Duration,
    reject_before: Option<DateTime<Utc>>,
) -> Result<VerifiedRolloutManifest, VerifyError>

Verify a signed rollout manifest. Callers MUST additionally discriminate the parsed manifest’s canonical RolloutId per RFC-0008 §6.3 against the advertised identifier (RolloutId::new(&m.channel, &m.channel_ref).as_str()) before consuming any field.