pub fn discover_trusted_approval_key_paths(spec_path: &Path) -> Vec<PathBuf>
Return default signing-key file locations associated with a spec path.