--- # nocheck: required-by-coverage — TODO: declare proper required_by ca-selfsigned: lifecycle: beta