Struct KeyRotationVerifier 

pub struct KeyRotationVerifier { /* private fields */ }

Tracks accepted key rotations for peer verification + grace windows.

During the grace period both the old and new pubkeys of a node are trusted for signature verification. After expiry the old key is revoked. Replays of the same (old, new) pair are rejected.

Implementations

impl KeyRotationVerifier

pub fn new(clock: Arc<dyn Clock>) -> Self

Create a verifier bound to the given clock (production: RealClock).

pub fn with_real_clock() -> Self

Production default with RealClock.

pub fn trust_peer( &self, node_id: &str, pubkey: [u8; 32], ) -> Result<(), KeyRotationError>

Seed a peer’s current public key (no expiry).

pub fn apply_rotation( &self, node_id: &str, event: &ChainEvent, ) -> Result<KeyRotationPayload, KeyRotationError>

Apply a verified key-rotation event for node_id.

Rejects:

• Invalid dual signatures
• Replay of the same (old, new) pair
• Rotations where the claimed old key is not currently trusted
• Rotations where the old key is past its grace period

pub fn is_trusted(&self, node_id: &str, pubkey: &[u8; 32]) -> bool

Whether pubkey is currently trusted for node_id (grace-aware).

pub fn applied_count(&self) -> usize

Number of applied (non-replay) rotations.