def verify(trusted_certs: [],
                   use_system_store: false,
                   allow_self_signed: false,
                   &verify_cb)

            digsig = self.signature
            digsig = digsig.cast_to(Signature::DigitalSignature) unless digsig.is_a?(Signature::DigitalSignature)

            signature = digsig.signature_data
            chain = digsig.certificate_chain
            subfilter = digsig.SubFilter.value

            store = OpenSSL::X509::Store.new
            store.set_default_paths if use_system_store
            trusted_certs.each { |ca| store.add_cert(ca) }

            store.verify_callback = -> (success, ctx) {
                return true if success

                error = ctx.error
                is_self_signed = (error == OpenSSL::X509::V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT ||
                                  error == OpenSSL::X509::V_ERR_SELF_SIGNED_CERT_IN_CHAIN)

                return true if is_self_signed && allow_self_signed && verify_cb.nil?

                verify_cb.call(ctx) unless verify_cb.nil?
            }

            data = extract_signed_data(digsig)
            Signature.verify(subfilter.to_s, data, signature, store, chain)
        end
def verify(trusted_certs: [],
                   use_system_store: false,
                   allow_self_signed: false,
                   &verify_cb)

            digsig = self.signature
            digsig = digsig.cast_to(Signature::DigitalSignature) unless digsig.is_a?(Signature::DigitalSignature)

            signature = digsig.signature_data
            chain = digsig.certificate_chain
            subfilter = digsig.SubFilter.value

            store = OpenSSL::X509::Store.new
            store.set_default_paths if use_system_store
            trusted_certs.each { |ca| store.add_cert(ca) }

            store.verify_callback = -> (success, ctx) {
                return true if success

                error = ctx.error
                is_self_signed = (error == OpenSSL::X509::V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT ||
                                  error == OpenSSL::X509::V_ERR_SELF_SIGNED_CERT_IN_CHAIN)

                return true if is_self_signed && allow_self_signed && verify_cb.nil?

                verify_cb.call(ctx) unless verify_cb.nil?
            }

            data = extract_signed_data(digsig)
            Signature.verify(subfilter.to_s, data, signature, store, chain)
        end
Verify a document signature.
   _:trusted_certs_: an array of trusted X509 certificates.
   _:use_system_store_: use the system store for certificate authorities.
   _:allow_self_signed_: allow self-signed certificates in the verification chain.
   _verify_cb_: block called when encountering a certificate that cannot be verified.
                Passed argument in the OpenSSL::X509::StoreContext.