Enforce canonical single-object DER validation across CSR, certificate, SPKI, CRL and persisted credential boundaries. Reject malformed, ambiguous and type-confused encodings while preserving streaming aggregate processing and existing PKI semantics.