pub fn checksum_of(digest: &[u8; 32]) -> String
sha256-<base64> for a 32-byte digest.
sha256-<base64>