Verify integrity manifest

Verify the ES256 signature and integrity of a .dcm + .dcm.sig pair.

Drop a DICOM file and its .dcm.sig integrity manifest. dcmage verifies the ECDSA P-256 (ES256) signature against the public key embedded in the manifest, then recomputes the SHA-256 hash of the bytes (and of the embedded audit snapshot) and compares them to the signed values. A green “Signature verified” — with the signer fingerprint — means the file is byte-for-byte identical to what was signed; a red “Verification FAILED” means a bad signature, a modified file, or a swapped/legacy/malformed manifest.

Tip The sidecar also contains the full audit trail snapshot captured at the moment of export — use it for chain-of-custody documentation. Caution This signs the detached .dcm.sig sidecar, not the DICOM file itself; in-file PS3.15 (CMS/PKCS#7) signatures for PACS interoperability are a separate, deferred feature.