Function verify_wan_against_record 

pub fn verify_wan_against_record(
    carried: &WanCarried<'_>,
    record: &WanKeyRecord,
    message: &str,
) -> Result<(), WanCheckFailure>

The checks against a directory record, in the §2.3 order: the chain, the record matching what was carried, then the message signature. Run after check_wan_envelope passes and a record was found. Replay is the caller’s (it needs state).