Function evaluate 

pub fn evaluate(
    policy: &TrustPolicy,
    allow: &[String],
    public_key: &str,
    known_key: Option<&str>,
    previous: Option<&TrustState>,
) -> TrustState

Evaluate the policy for a node’s key against what the registry already knows.

use majordomus_cli::mesh::trust::{evaluate, TrustPolicy, TrustState};
// TOFU trusts first use; a key change under a known node id is rejected regardless
assert!(evaluate(&TrustPolicy::Tofu, &[], "aa", None, None).is_trusted());
assert!(matches!(
    evaluate(&TrustPolicy::Tofu, &[], "bb", Some("aa"), None),
    TrustState::Rejected(_)
));

known_key is the key the registry last associated with this node id — with node ids derived from keys the two cannot disagree, so a mismatch can only mean a digest collision or registry corruption, and it is rejected loudly.