[Bug] Valid pkpass rejected with false "signature doesn't match content"

[abdu-frh]

The wallet rejects a cryptographically valid .pkpass with the error
"signature does not match content", even though the signature, manifest,
and file hashes are all correct and verifiable.

suspected

The pass signer certificate uses Apple's Pass-specific Extended Key Usage
1.2.840.113635.100.4.14 (and the pass-type binding
1.2.840.113635.100.6.1.16 = pass.de.digital-h.ride), not the
S/MIME emailProtection EKU. Reproducing the exact failure with OpenSSL:

$ openssl smime -verify -inform DER -in signature -content manifest.json \
    -CAfile AppleIncRootCertificate.cer
Verification failure
... PKCS7_verify: certificate verify error: unsuitable certificate purpose

---

With -noverify (content-only check) it succeeds, and with the purpose check
bypassed the full chain also verifies. This suspect the walet
verification rejects the cert because of an EKU/purpose mismatch
(OpenSSL-style X509_PURPOSE check expecting emailProtection/smimesign)
rather than an actual content/signature mismatch.

The same .pkpass imports correctly into Apple Wallet, Google Wallet and FossWallet