Strict DER, byte for byte
Why strictness is a security property
Most X.509 and CMS parser vulnerabilities are lenience bugs: two implementations accept the same bytes but disagree on what they mean, and the gap becomes a signature bypass or an identity confusion. A strict decoder collapses that ambiguity -- there is exactly one byte sequence for a given value, so what was signed is what was parsed.
Round-trip identity
A format parser here round-trips a valid input to identical bytes, and the byte ranges an external verifier hashes -- a certificate's tbs, a CMS eContent -- are surfaced raw from the input, never re-serialized. Signature verification therefore runs over the bytes that were actually presented, not over a best-effort re-encoding.
One structure, both directions
Each ASN.1 structure is declared once, and that single declaration drives both encode and decode. Context-tag handling (EXPLICIT versus IMPLICIT) cannot drift between the two directions, because there are no two implementations to drift.