Verifying DER encoded DSA/ECDSA signature with extra content? Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are "some valid DER encoded ASN.1" || "some extra bytes" – is the correct behavior to error out, or would it be more correct to proceed to attempt to verify just the DER encoded portion of the input (since it's self-delimiting)?

Specifically, I would like to know if there are any implications in relation to cryptographic security.
I don't think there's an exact "correct" behaviour in this case.
It would be up to the implementation to decide, since the spec is only concerned about the DER encoded portion.

If your implementation parses the input as it moves along only, and doesn't concern itself with the overall size, then it would work fine.

Having said that, I believe the best practice is always to verify input boundaries, and in this case, that would mean the trailing extra bytes should get caught. If they have no business being there, then they shouldn't.

There can be security or crypto implications if there's a bug in the parsing of the input.