26.9 rejects expired certificates, defaults PDF signatures to SHA-256, and makes LogLevel work. What breaks in an existing pipeline, why each change is right, and how to handle the exceptions....that still belongs in a release note. Finally, decide a log level...