The public half of every IIR this issuer signs with. A reader that should
accept these certificates needs the matching key enrolled under the same label —
a CVC arrives carrying 42 <IIR>, and the verifier looks it up by
that exact string.