Struct KeyTrustPolicy 

pub struct KeyTrustPolicy {
    pub mode: VerificationTrustMode,
    pub verify_x509_chains: bool,
    pub max_x509_chain_depth: usize,
    pub max_x509_candidate_paths: usize,
    pub allowed_legacy_signature_algorithms: HashSet<SignatureAlgorithm>,
    pub parameterized_rsa_pss: RsaPssPermission,
    pub certificate_signature_algorithms: Option<CertificateSignatureAlgorithms>,
    pub rsa_keys: RsaKeyPolicy,
    pub dsa_keys: DsaKeyPolicy,
    pub allowed_extended_key_usages: HashSet<ExtendedKeyPurpose>,
    pub check_crls: bool,
    pub verification_time: Option<SystemTime>,
}

X.509 and key-resolution decisions for verification.

Fields

mode: VerificationTrustMode

Whether mathematical validity alone is sufficient for the operation.

verify_x509_chains: bool

Require embedded or selected certificates to chain to a configured anchor.

max_x509_chain_depth: usize

Maximum validated path depth.

max_x509_candidate_paths: usize

Maximum complete or partial signature-valid path states generated.

allowed_legacy_signature_algorithms: HashSet<SignatureAlgorithm>

Legacy signature algorithms explicitly permitted for verification.

parameterized_rsa_pss: RsaPssPermission

Independent legacy-hash permission for parameterized RSA-PSS verification.

certificate_signature_algorithms: Option<CertificateSignatureAlgorithms>

Certificate and CRL signature permissions, independent of XML signatures. None permits supported classical algorithms but rejects PQ algorithms; Explicit permissions select either an exact allowlist (including PSS parameters) or all provider-supported algorithms for compatibility.

rsa_keys: RsaKeyPolicy

RSA requirements enforced for resolved verification keys and issuer keys.

dsa_keys: DsaKeyPolicy

DSA requirements enforced for resolved verification keys.

allowed_extended_key_usages: HashSet<ExtendedKeyPurpose>

Purposes accepted when any certificate in a path carries ExtendedKeyUsage.

An empty set accepts only paths whose certificates omit ExtendedKeyUsage or use anyExtendedKeyUsage; it does not treat TLS/code-signing purposes as a generic authorization for XML signatures.

check_crls: bool

Authenticate and enforce embedded CRLs during path validation. Requires Self::verify_x509_chains.

verification_time: Option<SystemTime>

Verification time override; None selects the system clock.

Trait Implementations

impl Clone for KeyTrustPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyTrustPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KeyTrustPolicy

Available on crate feature xmldsig only.

fn default() -> Self

Returns the “default value” for a type.

impl Eq for KeyTrustPolicy

impl PartialEq for KeyTrustPolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for KeyTrustPolicy