pub fn generate_agent_key(out: &Path) -> LinkResult<GeneratedAgentKey>Expand description
Mint a fresh Ed25519 agent keypair. The secret is written to out
(base64url PKCS#8, one line, 0600, refusing to overwrite); only public
identity is returned. The private key never enters a store and never
travels — requests carry per-request signatures instead (link.md §8).