Function create_certificate_request 

pub fn create_certificate_request(
    identity: &Arc<Ed25519Identity>,
    subject: &str,
) -> TrustResult<Vec<u8>>

Builds a PKCS#10 certificate-signing request for subject, self-signed by identity.

The returned DER is the holder’s side of the exchange: it carries identity’s public key and a signature over the request made with the matching private key, which is what verify_certificate_request checks. The private seed is reached only through IdentitySigner, so it is never serialised into an rcgen keypair.

The request is deliberately minimal — one common name, no subject alternative names, no requested extensions — because a request may not influence any certificate field other than the subject key, and a request carrying extensions would be rejected at verification.

Errors

Returns TrustError::CertificateGeneration if subject is empty or only whitespace, or if rcgen cannot build or sign the request.