The embedded server key may be the current signer or a deprecated signer whose rotation cutoff has not passed.
The embedded server key may be the current signer or a deprecated signer whose rotation cutoff has not passed.