Struct Store 

pub struct Store { /* private fields */ }

Local encrypted keystore.

Private keys are encrypted with AES-256-GCM before writing to disk. The encryption key is derived from a machine-specific secret so key files are useless if copied to another machine.

v2 will delegate to OS credential stores (Secure Enclave / TPM 2.0).

Implementations

impl Store

pub fn open(dir: impl AsRef<Path>) -> Result<Self, KeyError>

Opens or creates a keystore at dir.

pub fn generate(&self, set_default: bool) -> Result<KeyInfo, KeyError>

Generates a new Ed25519 keypair, encrypts and stores it. If set_default is true (or there is no current default), makes this key the default signing key.

pub fn default_signer(&self) -> Result<Box<dyn Signer>, KeyError>

Returns a boxed Signer for the current default key.

pub fn signer(&self, id: &str) -> Result<Box<dyn Signer>, KeyError>

Returns a boxed Signer for a specific key ID.

pub fn default_key_id(&self) -> Result<KeyId, KeyError>

Returns the default key ID.

pub fn list(&self) -> Result<Vec<KeyInfo>, KeyError>

Lists all keys.

pub fn set_default(&self, id: &str) -> Result<(), KeyError>

Sets the default signing key.

pub fn public_key(&self, id: &str) -> Result<Vec<u8>, KeyError>

Returns the public key bytes for a key ID.