CVE-2026-59643: OpenPGP inline-signature policy failures silently ignored

Affects Bouncy Castle for Java before 1.85. In OpenPGPMessageInputStream each one-pass signature is passed through a policy check that rejects weak hashes, unacceptable keys, unknown critical subpackets and pre-dated signatures. The enclosing catch block contains only a comment where a continue statement should be, so a policy rejection falls through to cryptographic verification and, if that succeeds, the signature is recorded as tested and correct. An attacker with a trusted-key signature over a policy-rejected hash can have it accepted.