The C1 tripwire for sign_grant: signing_identity/1 -> {:holder, ...}, and sign/2 counts calls. sign_grant MUST reject a :holder handle BEFORE sign/2, so sign_call_count/0 stays 0. (The mirror of sign_report's CountingKeyHandle, which asserts sign/2 is called exactly once — pointed the other way.)