DerReader.readTlvRaw

Reads the next complete TLV and returns its original encoding.

The returned bytes are the tag, length, and value exactly as they appear in the source buffer, as a slice into the underlying data. This is what signature verification must hash when the signed structure is re-read: re-encoding the parsed fields can produce different bytes for inputs that are not strictly minimal DER (e.g. a non-minimal length octet count).