//! Koi Crypto - cryptographic utilities for the certmesh capability.
//!
//! Provides ECDSA P-256 key management with encryption at rest,
//! TOTP generation/verification with rate limiting, certificate
//! fingerprinting, and ECDSA signing/verification.
//!
//! ## Optional backends
//!
//! - `keyring` (default): OS credential-store key sealing ([`tpm`]). Off → the vault
//! falls back to its passphrase backend and TOTP unlock slots are unavailable.
//! - `qr` (default): QR rendering in [`totp`] (qrcode + image PNG codec). Off → the
//! renderers return the `otpauth://` URI text verbatim.