Every reference digest matches, one of them covers the whole document, and the SignedInfo signature verifies with signer's key. Whether signer is a certificate you trust is the caller's decision.
final bool valid;