Function load_kernel_signing_backend_after_self_quote 

pub fn load_kernel_signing_backend_after_self_quote(
    crypto_floor: KernelCryptoFloor,
    classical_keypair: Keypair,
    pq_seed: Option<&[u8; 32]>,
    quote_bytes: &[u8],
    verifier: &dyn KernelSelfQuoteVerifier,
) -> Result<Box<dyn SigningBackend>, KernelBootError>

Load the kernel signing backend, gating the PQ half on a verified self-quote.

Boot logic:

• Under KernelCryptoFloor::AllowClassical the self-quote step is skipped: there is no PQ key to gate, and a classical-only deployment may not even ship a TEE container. The function returns the classical-only backend produced by kernel_signing_backend.
• Under KernelCryptoFloor::AllowHybrid or KernelCryptoFloor::PqRequired the function consults the verifier port FIRST. Only on KernelSelfQuoteOutcome::verified does it construct the hybrid backend. A rejected outcome returns KernelBootError::SelfQuoteRejected without ever materializing the MlDsa65Backend.

quote_bytes is the on-the-wire self-quote produced by the TEE container. For tests, an empty slice combined with a mock verifier is fine; for production the bytes come from chio-tee.

Errors

• KernelBootError::SelfQuoteRejected when the verifier rejects the self-quote and the floor mandates a PQ key.
• KernelBootError::SigningBackend when the floor or PQ seed is misconfigured (forwarded from KernelSigningBackendError::HybridFloorRequiresPqKey or KernelSigningBackendError::PqKeyImportFailed).