addKey method

void addKey(
  1. CryptographicMaterial material
)

Files material in the container its own enrollmentId names — that enrollment's when it has one, the atSign's when it is null.

This is the write path, so it refuses a second live enrollment: one per install is what this build produces. Reading does not, and the asymmetry is deliberate — see AtKeysAssurance.refuseSecondLiveEnrollment.

Implementation

void addKey(CryptographicMaterial material) {
  const AtKeysAssurance()
      .refuseSecondLiveEnrollment(existing: keys, candidate: material);
  _file(material);
}