validate: rewrite the summary key in plain language; fix the SKIP label

The end-of-run legend was written as internal dev shorthand (cryptic A/B
categories, "Weierstrass bignum math works", "RFC 9090 OID fallback", a
draft-19-vs-20 paragraph shown even on draft-20 runs) that an outside reader
cannot follow. Replace it with a plain-language key explaining PASS / XFAIL /
SKIP / FAIL, and gate the draft-19 "withcert" note to --version 01 where it
actually applies.

Also fix the SKIP summary label: it read "(no reference data)", which is wrong
when the reference data IS present but the tool does not yet support the
algorithm (e.g. signature verification for brainpool/RSA/SM2/Ed448). It now
reads "(not run, see key)" and the key states both causes.

Text only; counts unchanged (PASS 125, XFAIL 68, SKIP 8, FAIL 0).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: highlunder

c509_demo_impl/validate_c509.sh

@@ -1039,19 +1039,31 @@ echo "============================================================${C_RST}"
 printf "  %-35s %d\n" "Total tests run:" "${TOTAL}"
 printf "  ${C_PASS}%-35s %d${C_RST}\n"  "PASS:"                       "${PASS}"
 printf "  ${C_XFAIL}%-35s %d${C_RST}\n" "XFAIL  (expected, see key):" "${XFAIL}"
-printf "  ${C_SKIP}%-35s %d${C_RST}\n"  "SKIP   (no reference data):" "${SKIP}"
+printf "  ${C_SKIP}%-35s %d${C_RST}\n"  "SKIP   (not run, see key):" "${SKIP}"
 printf "  ${C_FAIL}%-35s %d${C_RST}\n"  "FAIL   (unexpected):"        "${FAIL}"
 echo ""
-echo "  Expected-failure key (draft-ietf-cose-cbor-encoded-cert):"
-echo "    A   Type 2 natively-signed (section *.4 or 3.11.3): §2.1, §2.3.5"
-echo "        SM2 and FRP256v1 type-3 PASS — Weierstrass bignum math works"
-echo "        RFC 9090 OID fallback IMPLEMENTED — unconvertible cert PASSES"
-echo "    B   Type-2 signing (f2): unsupported key type, or f2 cannot encode the"
-echo "        cert as type-2 (e.g. id-alg-unsigned X25519/X448 end-entity)"
-echo "  RESOLVED for draft-20 — the r2 type-2 CSR path (RFC 6955 DhSig + the nested"
-echo "  'withcert' embedded cert) and CRT-template decode/round-trip (§9) now PASS."
-echo "  Running --version 01 leaves the §8.7 withcert CSR as an expected draft-19-vs-20"
-echo "  divergence (its embedded cert is bytes .cbor-wrapped only from draft-20)."
+echo "  Key — what each result means:"
+echo "    PASS   the reference implementation reproduced the draft's vector:"
+echo "           the C509 encoding is byte-exact, the signature is cryptographically"
+echo "           verified, or the X.509 DER round-trips byte-exact."
+echo "    XFAIL  \"expected failure\" — the vector does not apply to this particular"
+echo "           check, by design (NOT a bug, and counted separately from FAIL)."
+echo "           The main case: a natively-signed Type-2 certificate signs over"
+echo "           CBOR, so it has no equivalent X.509 DER and cannot be round-tripped"
+echo "           through DER. Those same Type-2 vectors are still checked — and"
+echo "           pass — in the encoding and signature-verification phases. Every"
+echo "           XFAIL line above prints its own specific reason."
+echo "    SKIP   the check could not be run — either an input it needs is not"
+echo "           present, OR the tool does not yet support that algorithm."
+echo "           (Signature verification currently covers ECDSA P-256/P-384/P-521"
+echo "           and Ed25519; brainpool / RSA / SM2 / Ed448 are not yet wired.)"
+echo "    FAIL   a genuine, unexpected mismatch — a bug to fix."
+if [ "${VERSION}" = "01" ]; then
+    echo ""
+    echo "  Note (--version 01 only): the section 8.7 \"withcert\" CSR is an expected"
+    echo "  draft-19-vs-20 difference — its embedded certificate is bytes .cbor-wrapped"
+    echo "  only from draft-20 — so it will not match the older draft-19 vector."
+fi
 echo ""
 if [ "${FAIL}" -eq 0 ]; then
     echo -e "${C_PASS}${C_BOLD}  All tests passed or accounted for as expected failures.${C_RST}"