Function authorize_csr_der 

pub fn authorize_csr_der(
    csr_der: &[u8],
    identity: &str,
    policy: &EnrollAuthzPolicy<'_>,
) -> Result<(), String>

Authorize a DER-encoded CSR against the authenticated identity and label policy. Convenience wrapper over authorize_csr for callers that hold raw CSR bytes rather than a parsed [CertificationRequest].

A malformed CSR is reported as an authorization failure (the enroll handler that parses it for issuance will surface the parse error in detail).