pub fn capability_signer() -> Result<Arc<dyn Signer>>
Loads the capability signer; falls back to the trust signer when none is configured.