And then if you sign sibling documents, you essentially have most of the same problems you have with ensuring a zip file doesn’t have a malicious payload, because file cannonicalization is fraught with issues.

It took me a couple pages of don’ts to nail it down, and I missed a big one that I didn’t see until pretty late in the project.