Re-check the 32-capability audit:
  sha256sum -c SHA256SUMS
  python3 verify_capability_audit.py.txt CAPABILITY_AUDIT.json evidence-root.pub.json
  (the public key is also served at /proof/bundle/claims/evidence-root.pub.json on every site)