Module local_keygen 

Client-side did:key generation.

Replaces the server-side POST /auth/credentials endpoint for flows where an operator or consumer wants an admin identity bound to a context. The key never crosses the wire:

1. Caller mints a random 32-byte Ed25519 seed locally.
2. Derives did:key:... from the public half.
3. Sends POST /acl with the public DID + desired role/contexts.
4. Keeps the private half in the returned CredentialBundle — either to use locally or to seal via sealed_producer for transport.

The VTA never sees the private key. Contrast with the pre-5c6 flow where POST /auth/credentials generated the key server-side and returned it in a base64 JSON field — a private key in flight over plaintext JSON.

Functions

generate_admin_did_key

Generate a fresh Ed25519 keypair, derive a did:key, and package the result as a CredentialBundle bound to the given VTA DID/URL.

generate_unbound_admin_did_key

Mint a fresh Ed25519 did:key with no VTA binding.