QWAC validation

Hello there,

Starting from iOS 18.4, support was included for QWAC Validation and QCStatements.

Using the official QWAC Validator at: https://eidas.ec.europa.eu/efda/qwac-validation-tool

I was able to check that the domain "eidas.ec.europa.eu" has a valid QWAC certificate. However, when trying to obtain the same result using the new API, I do not obtain the same result.

Here is my sample playground code:

import Foundation
import Security
import PlaygroundSupport

PlaygroundPage.current.needsIndefiniteExecution = true

@MainActor
class CertificateFetcher: NSObject, URLSessionDelegate {
    
    private let url: URL
    
    init(url: URL) {
        self.url = url
        super.init()
    }
    
    func start() {
        let session = URLSession(configuration: .ephemeral, delegate: self, delegateQueue: nil)
        let task = session.dataTask(with: url) { data, response, error in
            if let error = error {
                print("Error during request: \(error)")
            } else {
                print("Request completed.")
            }
        }
        task.resume()
    }
    
    nonisolated func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge, completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard let trust = challenge.protectionSpace.serverTrust else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        if let certificates = SecTrustCopyCertificateChain(trust) as? [SecCertificate] {
            self.checkQWAC(certificates: certificates)
        }
        
        let credential = URLCredential(trust: trust)
        completionHandler(.useCredential, credential)
    }
    
    nonisolated func checkQWAC(certificates: [SecCertificate]) {
        let policy = SecPolicyCreateSSL(true, nil)
        
        var trust: SecTrust?
        guard SecTrustCreateWithCertificates(certificates as CFArray, policy, &trust) == noErr, let trust else {
            print("Unable to create SecTrust")
            return
        }
        
        var error: CFError?
        guard SecTrustEvaluateWithError(trust, &error) else {
            print("Trust evaluation failed")
            return
        }
        
        guard let result = SecTrustCopyResult(trust) as? [String : Any] else {
            print("No result dictionary")
            return
        }
        
        let qwacStatus = result[kSecTrustQWACValidation as String]
        let qcStatements = result[kSecTrustQCStatements as String]
        
        print("QWAC Status: \(String(describing: qwacStatus))")
        print("QC Statements: \(String(describing: qcStatements))")
    }
    
}

let url = URL(string: "https://eidas.ec.europa.eu/")!
let fetcher = CertificateFetcher(url: url)
fetcher.start()

Which prints:

QWAC Status: nil
QC Statements: nil
Request completed.

Am I making a mistake while using the Security framework? I would greatly appreciate any help or guidance you can provide.