Algorithm dispatch and structural validation.
This crate is the runtime seam between an Algorithm
selector and the concrete primitive that implements it. Given an
algorithm value it routes keygen, sign/verify, key agreement, KEM
encapsulate/decapsulate, AEAD, and hashing to the matching primitive
adapter, and it binds public keys to their multicodec/multikey
encodings.
Two safety properties are enforced here rather than left to callers:
[verify] fails closed — an invalid signature is an
[AlgorithmError::SignatureInvalid], never Ok(false) — and every
secret returned (generated private keys, shared secrets, decapsulated
secrets) is carried in a zeroizing wrapper. Length and key-shape checks are
performed by the selected primitive's typed constructors and are exercised
by dispatch-level negative tests so algorithm routing cannot silently
truncate, pad, or reinterpret caller bytes.
Constant-time behavior for authentication comparisons is inherited from the wrapped primitive crates. Dispatch does not reimplement tag, MAC, or signature comparison logic; it routes to the primitive verifier and maps the verifier's typed failure into this crate's fail-closed result.