required
Optional application-identified IACA direct issuer, encoded as unpadded Base64URL DER. When set, require that exact direct issuer on the validated path and an issuer-alternative-name email or URI contact in the reader certificate. The application identifies the issuer's IACA role; this restriction does not add trust. Invalid DER is reported as an invalid certificate path during evaluation, including through Swift.