Function only_bound_subkeys 

fn only_bound_subkeys(cert: Cert) -> Cert

cert without the subkeys its own primary key does not bind under the policy (bound by nothing, or by another key): what a lookup brings of yours adds only what your key signed (review of 19 October 2026, Info: such subkeys were inert, but kept, and a security key’s travelled in its shared file).