Struct SigningKey 

pub struct SigningKey { /* private fields */ }

The confidential client’s long-lived ES256 signing key.

Implementations

impl SigningKey

pub fn generate(kid: &str) -> Self

Generate a fresh P-256 key.

Draws from the OS CSPRNG via getrandom, the same source as the rest of the app, rather than pulling in a second RNG stack. A uniformly random 32-byte value is a valid P-256 scalar with overwhelming probability; the retry covers the ~2^-32 case where it lands outside the curve order.

pub fn from_jwk_json(jwk_json: &str, kid: &str) -> Result<Self>

Parse a JWK, tolerating the extra members (kid, alg, key_ops, use) that both this module and the sidecar attach.

pub fn to_jwk_json(&self) -> Result<String>

The PRIVATE JWK, for persistence. Carries kid/alg/key_ops so a rollback to the sidecar finds the key under the same identifier.

pub fn public_jwk(&self) -> Result<Value>

The PUBLIC JWK — what /jwks.json serves. Never contains d.

pub fn jwks_document(&self) -> Result<Value>

The document served at jwks_uri, so the PDS can verify our assertions.

pub fn thumbprint(&self) -> Result<String>

RFC 7638 thumbprint of this key’s public half.

pub fn public_thumbprint_of(jwk_json: &str) -> Result<String>

RFC 7638 thumbprint of an arbitrary EC JWK document.

pub fn kid(&self) -> &str