Function valid_kid 

pub fn valid_kid(id: &str) -> bool

Key-id charset: printable, no TOML metacharacters, no controls, non-empty. Enforced when writing sidecars, when parsing them, and when loading trusted sets — an id that cannot round-trip byte-identical through TOML is rejected everywhere (injection and log-forging resistance).