pub fn spki_sha256_hex(cert_der: &[u8]) -> Result<String, String>
SHA-256 fingerprint of SubjectPublicKeyInfo (SPKI) as lowercase hex.