Without this copy, the buffer may be re-used in the json package, causing missing or corrupted content for the long-lived SignedManifest object. By creating a new buffer, owned by the SignedManifest object, the content remains stable.