Security release. Two defects in 4.2.0, found by Timothy Lee 2026-08-31.

settlement.complete was decided outside the party_keys guard, as a set
comparison over trigger key_id strings, so a Receipt whose triggers were
fabricated verified when no party keys were supplied. It is now recorded
as unestablished rather than passed.

sign_trigger no longer accepts a caller-supplied key_id: the identity is
bound at server start, not chosen per call.

Also ships the conformance kit in the sdist, which setuptools had been
leaving behind.

Anyone on 4.2.0 verifying settlement Receipts should upgrade.