Version 1.22.2 adds two signing-state safeguards, but public physical validation of the alleged substitution path is limited to Flex.