... and now for something completely different:
According to the ESS RFC on page 16, step 9:
9. The ASN.1 DER encoded Receipt content MUST be directly encoded within
the signedData encapContentInfo eContent OCTET STRING defined in [CMS].
Should eContent be a DER-encoding of the receipt?
Should eContent be a DER-encoding of an OCTET STRING containing the
DER-encoding of the receipt?
The word "directly" seems to indicate that the former is the correct one.
Just tell me I'm not crazy.