Each distinct TLS issuer now produces its own CheckState with Subject set to the issuer label, instead of being folded into a single concatenated status. Aligns with the SDK v2 contract (see checker-sdk-go/migrate-v2.md).