Module trust 

Trusted keys, and the signature check every consumer path begins with.

A trust anchor is a file the caller names. This crate never discovers a key, never fetches one, and never treats a key shipped beside an archive as trusted because it arrived: whoever calls decides which public keys they accept, and that decision is the whole basis of every guarantee below it.

A document is accepted when any one of its signatures verifies against a trusted key. That is what lets a document signed by both an outgoing and an incoming key stay valid across a rotation, and it is why a signature naming an unknown key is skipped rather than treated as an attack — a build that carries only one of the two keys must still be able to verify.

Structs

TrustedKey

One public key a caller is willing to accept signatures from.

VerifiedPayload

The payload of a document whose signature has verified.

Functions

load_trusted_keys

Reads a trust file holding either a single key or a { "keys": [...] } bundle.

verify_signed_document

Verifies a signed document against a set of trusted keys and returns its payload.

verify_signed_document_with_key_file

Verifies a signed document against a trust file the caller names.