Enum SigningKeyMaterial 

pub enum SigningKeyMaterial {
    Off,
    Hmac {
        kid: String,
        key: Zeroizing<Vec<u8>>,
    },
    Ed25519 {
        kid: String,
        signing_key: SigningKey,
    },
}

Runtime signing key material.

Note: Debug is implemented manually so that key bytes never leak into log output. We surface the variant + kid only.

Variants

Off

Signing disabled — passthrough, no envelope wrapping.

Hmac

HMAC-SHA256 with a shared symmetric key.

Fields

kid: String

Signer kid embedded in the SignedEventEnvelopeV1.

key: Zeroizing<Vec<u8>>

Shared HMAC key bytes. Red-team wave-2 T1b: Zeroizing<Vec<u8>> so the secret key is wiped on drop instead of lingering in freed allocations.

Ed25519

Ed25519 asymmetric signing.

Fields

kid: String

Signer kid embedded in the SignedEventEnvelopeV1.

signing_key: SigningKey

Ed25519 signing key (private). Verifier holds the matching VerifyingKey.

Implementations

impl SigningKeyMaterial

pub fn is_off(&self) -> bool

True iff this is the SigningKeyMaterial::Off variant.

pub fn kid(&self) -> Option<&str>

Signer kid for the active variant; None for SigningKeyMaterial::Off.

pub fn from_env() -> Result<Self, SignOutboundError>

Load signing material from env vars (see module docs).

• Unset / "off" → SigningKeyMaterial::Off.
• "hmac-sha256" → requires kid + HMAC key, rejects ed25519 key.
• "ed25519" → requires kid + ed25519 seed, rejects HMAC key.

Trait Implementations

impl Debug for SigningKeyMaterial

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Custom Debug that NEVER prints key bytes — only variant + kid. This matters because operators sometimes pipe tracing output into log stores that retain forever; an accidental {:?} of a SigningKeyMaterial must not become a key-leak channel.