Module custody 

Kernel-side passkey-capability verification.

The kernel sits behind the issuer surface (chio_custody_hw::IssuerService). When a caller presents a PasskeyCapability to the kernel, the kernel delegates to PasskeyCapabilityVerifier which:

1. Refuses any capability with an empty signature (custody contract: empty signatures NEVER verify).
2. Checks the audience pin matches the kernel’s configured identity.
3. Checks the capability is live (now < exp).
4. Reconstructs the signing message via chio_custody_hw::mint::signing_message and verifies the detached signature against the configured issuer chio_core_types::crypto::PublicKey.

All four gates are fail-closed: any path that does not strictly satisfy its precondition returns a typed CustodyError with a stable urn:chio:error:custody:* code.

Async discipline

The verifier surface takes no &mut self. PasskeyCapabilityVerifier::verify takes &self so it can be shared behind an Arc<> and consumed concurrently from the async kernel.

Structs

PasskeyCapabilityVerifier

Kernel-side verifier for PasskeyCapability envelopes.