v1.4.0

1.4.0 (2026-09-16)

• Feature: #47 Support signed WS-Security timestamps. Signature.new accepts a timestamp: true option (plus optional created_at/expires_at) that adds a wsu:Timestamp to the Security header and covers it with its own digest Reference, so the timestamp cannot be altered without invalidating the signature.
• Feature: #46 Handle InclusiveNamespaces configuration when verifying signatures.
• Fix: #62 Fix signature verification for multi-token documents and signed attachments. The signer certificate is now selected via the SecurityTokenReference instead of always taking the first BinarySecurityToken, and cid: attachment references can be verified against caller-supplied decrypted_attachments.