Consider caching digest values for SignedCms.VerifySignature

Imagine that all 538 US presidential electors parallel-sign their vote tabulation.

Odds are, all 538 only used one data digest algorithm. So, why digest multiple times?

If SHAKE and friends are allowed in SignedCms with parameterized length, then the cache is theoretically unbounded. If only the fixed size outputs of them are defined for CMS, then the cache has a limit of around a dozen algorithms that it could possibly grow to.

The best place for the cache is probably ContentInfo?

Start by tracing SignedCms.VerifySignature and inspect ContentInfo, which the issue identifies as a possible cache location. Determine how repeated digest algorithms are handled during parallel signature verification, including the stated SHAKE parameter-length concern. Done means the design has bounded, correct digest reuse without changing verification behavior.

Written by the indexing model from the issue text.