drop piv / cac card artifact dump · parse credentials + certs · runs locally
drop piv / cac card artifact dump · local only
heuristic screener · vendor schema varies · not definitive proof