X509Crl.tbs (src/x509_crl.ts:175) and X509Certificate.tbs
(src/x509_cert.ts:251) are both `private` by design — the
ToBeSigned block is an implementation detail of verify().

The assertion in test/x509_crl.ts:59 violates that encapsulation
and emits TS2341 under `tsc --noEmit`. CI's `npm run coverage`
uses vitest's transpile-only path which skips visibility checks,
so this slipped through review of #127.

The remaining assertions in the same test already exercise the
underlying tbsCertList structure (issuer, thisUpdate, nextUpdate,
signatureAlgorithm, signature), so removing the line does not
reduce meaningful coverage.