Open extracts and verifies every member against the manifest before the reader is usable, so a corrupt archive is refused before a restore writes its first document rather than halfway through.
KeyFingerprint is a pointer so an archive that recorded no key is a state restore can report, not a default it silently treats as a match.
Fingerprint hashes the raw key bytes rather than the hex string, so the same key written in different cases fingerprints identically.
mrhid6