keysource

type File struct {
	// Path is the PEM private-key path (PKCS#8). Required.
	Path string

	// VerificationMethodID is the DID URL embedded in proof.verificationMethod.
	// Required: receipts with an empty verification method aren't independently
	// verifiable.
	VerificationMethodID string

	// RequireOwnerOnly, when true, refuses to load a key whose file mode allows
	// group or world access. Defaults to true; tests can disable for tmpfile
	// fixtures whose perms are platform-controlled.
	RequireOwnerOnly bool
	// contains filtered or unexported fields
}

type KeySource interface {
	// Init loads or wires up key material. Called once at daemon startup.
	// Implementations MUST fail loudly when keys are missing or malformed —
	// silently signing with a default-generated key would defeat the audit
	// property.
	Init() error

	// Sign returns the Ed25519 signature over message. The signature is the
	// raw 64-byte form; the caller multibase-encodes it.
	Sign(message []byte) ([]byte, error)

	// PublicKey returns the PEM-encoded SPKI public key for verifiers.
	PublicKey() (string, error)

	// VerificationMethod returns the DID URL or other reference verifiers use
	// to look up the public key. Daemon embeds this in proof.verificationMethod.
	VerificationMethod() string

	// Teardown wipes any in-memory key material. Called on graceful daemon
	// shutdown.
	Teardown() error
}