Rebuilding the same source package on Groovy produces a "good" libnss3 package (the Impish dogtag-pki autopkgtests pass when using it). This means that a build-dependency that was upgraded in Hirsute caused the regression.
(As Christian made me notice rebuilding on Hirsute *release* with no updates may still produce a broken package, even if the "good" package in the archive was built on Hirsute. This is because back when the Hirsute package was built Hirsute was still in development. The true way to go back to what Hirsute was initially is to go back to Groovy.)
Rebuilding the same source package on Groovy produces a "good" libnss3 package (the Impish dogtag-pki autopkgtests pass when using it). This means that a build-dependency that was upgraded in Hirsute caused the regression.
(As Christian made me notice rebuilding on Hirsute *release* with no updates may still produce a broken package, even if the "good" package in the archive was built on Hirsute. This is because back when the Hirsute package was built Hirsute was still in development. The true way to go back to what Hirsute was initially is to go back to Groovy.)