Whole days until expiry, rounded away from zero, so a credential with
eight hours left reports 1 rather than 0. Negative once expiry has
passed (-2 means "expired two days ago"). Null when there is no expiry.
The normalized expiry instant, or null when the credential never expires (or carried an unparseable value — see EvaluateExpiration).
Milliseconds until expiry. Negative once expiry has passed. Null when there is no expiry.
Lifecycle state relative to now.
Whether the credential may be handed to a caller under the configured
policy. False only for an expired credential under 'block' that has
exhausted its grace period.
True when the credential is expired but still inside the configured grace period. Always false when the credential is not expired.
The result of evaluating a credential's expiry against the clock.