Function spki_pin_matches 

pub fn spki_pin_matches(
    leaf_pem_or_der: &str,
    expected_hex: &str,
) -> Result<bool, String>

SPKI pin match: leaf SPKI fingerprint equals expected hex (case-insensitive).