Struct TrustedPublicKey 

pub struct TrustedPublicKey { /* private fields */ }

A public key authorized by certificate path validation, not just DER parsing. Only the validating resolver can create it; callers may inspect evidence.

Implementations

impl TrustedPublicKey

pub fn evidence(&self) -> &X509TrustEvidence

Validated certificate identities and the operation’s validation time.

Trait Implementations

impl VerifyingKey for TrustedPublicKey

fn verification_spki( &self, algorithm: SignatureAlgorithm, ) -> Result<Option<&[u8]>, DsigError>

Borrow public SPKI for native verification, validating method/key binding. Opaque external keys may return None; native providers then fail closed.

fn ecdsa_encoding(&self) -> EcdsaSignatureValueEncoding

Wire encoding already selected by the immutable verification policy.

fn verify_candidate_keys( &self, verify: &mut dyn FnMut(&dyn VerifyingKey) -> Result<bool, DsigError>, ) -> Result<Option<bool>, DsigError>

Composite resolvers may try individual keys through the selected engine. None identifies a leaf handle. Wrappers must preserve per-key policy when forwarding the visitor; no public/private key copy is required.

fn verify_with_context( &self, algorithm: SignatureAlgorithm, context: &SignatureContext, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify with validated domain separation, rejecting unsupported contexts.

fn validate_policy(&self, policy: &VerificationPolicy) -> Result<(), DsigError>

Validate this key against the operation’s immutable trust policy.

fn validate_signature_value( &self, algorithm: SignatureAlgorithm, signature: &[u8], ) -> Result<bool, DsigError>

Check that signature_value has the wire framing required by the declared algorithm and this key before provider dispatch.

fn validate_signature_value_with_policy( &self, policy: &VerificationPolicy, algorithm: SignatureAlgorithm, signature: &[u8], ) -> Result<bool, DsigError>

Validate wire framing under the operation’s immutable compatibility policy.

fn verify( &self, algorithm: SignatureAlgorithm, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify signature_value over signed_data with the declared algorithm.

fn verify_with_policy( &self, policy: &VerificationPolicy, algorithm: SignatureAlgorithm, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify after applying operation-scoped compatibility semantics.

fn provider_binding(&self) -> Option<&ProviderBinding>

Exact external execution domain; a key cannot be moved between token sessions.