Paste a credential (compact SD-JWT). Signature is checked against the published issuer JWKS. Disclosure decoding is best-effort for display.