Must work with “oldest-pass” value, since it's part of the protocol (Section 5.2, Step 5)

[kitterma]

Need to add signing/verification tests for proper usage.