Stage 5c: the bench times the openings with certificates and seals

tool/open_bench.dart also opens format3_signed_cms, a signature of alg 2
by two signers each with a seal, and format3_sealed, a signature of alg 1
and a seal of seal_type 2, from securitycms_vectors.g.dart, and times
inside each opening the evaluation of its security area by the default
evaluator. On the VM an opening takes about 51 ms, of which the area
about 9 ms; compiled to JavaScript, about 1 s, of which the area 145 ms
and 49 ms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tool/open_bench.dart

@@ -1,10 +1,13 @@
-// Times the opening of datekeys-dart, stage 4c, on the VM and compiled to
-// JavaScript: the opening in memory of a fixture of each kind (time_only,
-// time_and_key with a .dkk, and format 3 with its files), each with the
-// verification of its release, and the throughput of a capsule of 64 MiB
-// opened from a source in streaming, in format 1 and in format 3, which
-// large_capsule.dart makes from the fixtures. It reads no file: the
-// fixtures are those of test/vectors/open_vectors.g.dart.
+// Times the opening of datekeys-dart, stages 4c and 5c, on the VM and
+// compiled to JavaScript: the opening in memory of a fixture of each kind
+// (time_only, time_and_key with a .dkk, and format 3 with its files), each
+// with the verification of its release; the opening of the two fixtures of
+// format 3 whose security area holds a signature of alg 2 and a seal of
+// seal_type 2, with the time of the evaluation of that area alone; and the
+// throughput of a capsule of 64 MiB opened from a source in streaming, in
+// format 1 and in format 3, which large_capsule.dart makes from the
+// fixtures. It reads no file: the fixtures are those of
+// test/vectors/open_vectors.g.dart and securitycms_vectors.g.dart.
 //
 //   dart run tool/open_bench.dart
 //
@@ -19,6 +22,7 @@ import 'package:datekeys/datekeys.dart';
 
 import '../test/large_capsule.dart';
 import '../test/vectors/open_vectors.g.dart';
+import '../test/vectors/securitycms_vectors.g.dart';
 
 typedef Json = Map<String, Object?>;
 
@@ -146,6 +150,50 @@ Future<void> main() async {
     print('  $label: ${median(times).toStringAsFixed(1)} ms');
   }
 
+  // The fixtures with certificates: the opening, and inside it the
+  // evaluation of the security area by the default evaluator, the reader of
+  // CMS included.
+  final cms =
+      ((jsonDecode(securityCmsFixturesJson) as Json)['fixtures']! as List)
+          .cast<Json>();
+  for (final (label, r) in [
+    ('format 3, a signature of alg 2 by two signers, each sealed', cms[0]),
+    ('format 3, a signature of alg 1 and a seal of seal_type 2', cms[1]),
+  ]) {
+    final dkc = fromHex(r['dkc']! as String);
+    final times = <double>[];
+    final evaluations = <double>[];
+    for (var i = 0; i < runs; i++) {
+      verifyRelease(quicknet(), releaseOf(other).round, releaseOf(other));
+      final evaluation = Stopwatch();
+      final sw = Stopwatch()..start();
+      final o = await openCapsule(
+        dkc,
+        OpenOptions(
+          source: suppliedRelease(releaseOf(r)),
+          now: () => parseRfc3339(r['unlock_at']! as String),
+          sink: DiscardFiles(),
+          evaluator: (input) {
+            evaluation.start();
+            final v = evaluateSecurityInput(input);
+            evaluation.stop();
+            return v;
+          },
+        ),
+      );
+      times.add(sw.elapsedMicroseconds / 1000);
+      evaluations.add(evaluation.elapsedMicroseconds / 1000);
+      final want = (r['verdicts']! as Json)['signature'];
+      if (!o.ok || o.verdicts?.signature?.code != want) {
+        throw StateError('$label: ${o.error} ${o.verdicts}');
+      }
+    }
+    print(
+      '  $label: ${median(times).toStringAsFixed(1)} ms, of which the '
+      'security area ${median(evaluations).toStringAsFixed(1)} ms',
+    );
+  }
+
   // Throughput: 64 MiB on the VM, 16 MiB on Node.js, from a source.
   final mib = js ? 16 : 64;
   final content = pattern(mib << 20);