Nothing in src/ differs from the 2.0.0
tag. This release exists so that ^2 resolves to that code.
composer require lsnepomuceno/signet-pdf:^22.0.0 was tagged twice. The first tag pointed at a commit that predated
two-phase signing, the signature policy in validation and the security store key
fix, all three of which the 2.0.0 notes describe, so it was deleted and re-cut
onto the commit that carries them. Packagist read GitHub's tag list during the
thirty-nine seconds between the two pushes and cached the earlier commit against
the version, and a published version's reference cannot be corrected from the
repository side.
So what 2.0.0 promised is what this release delivers, and the 2.0.0 notes are
the ones to read. If you installed 2.0.0 from Packagist at any point,
composer update lsnepomuceno/signet-pdf moves you onto it.
Documentation: lsnepomuceno.github.io/signet-pdf.