Enter an entity URL or well-known base and get a deterministic list of expected artifacts. This is a helper for publishers and auditors (read-only).
Note: signature verification is intentionally performed client-side (minisign) for portability and auditability.