Function signature_and_verify 

fn signature_and_verify(
    signed_bytes: &[u8],
    signature_der: &[u8],
    public_key_pem: &[u8],
) -> Result<(IGVM_VHS_SNP_ID_BLOCK_SIGNATURE, IGVM_VHS_SNP_ID_BLOCK_PUBLIC_KEY)>

Parse a DER ECDSA signature + public key, cryptographically verify the signature over signed_bytes (the signing payload the signer signed), and return the IGVM ID block signature and public-key structures (big-endian in, PSP little-endian layout out).

Verifying here catches a wrong key or corrupt signature at build time, rather than only when the guest fails to launch on real hardware.