26.9 rejects expired certificates, defaults PDF signatures to SHA-256, and makes LogLevel work. What breaks in an existing pipeline, why each change is right, and how to handle the exceptions....certificate outside its validity window is rejected rather than used...covers the other end of the window and is deliberately independent:...