Function is_signature_disallowed 

pub fn is_signature_disallowed(signature: &str) -> bool

True when FIPS mode is active and the given signature scheme is NOT on the FIPS-approved allowlist. Used by snapshot validation to reject Ed25519 certificates and other non-approved signature schemes.

When FIPS mode is disabled (OSS), always returns false (no rejection).