pqNativeActivationMaterial function

Future<PqNativeActivationMaterial> pqNativeActivationMaterial({ required String atSign, required Set<SigningAlgoType> dataSigningKeyAlgorithms, String keyEstablishmentAlgo = SecretSharingAlgos.xWing, })

Mints everything that makes an activation PQ-native beyond its ML-DSA-65 APKAM: a data signing key the enrollment owns from birth, and the first enrollment's key package, both on the enroll:request that creates the record.

One call rather than several assignments, because they go out of step: minting the ML-DSA APKAM alone leaves the record with no key package, and a signing key handed to the request but not to the key-package builder publishes a record naming one key beside a package signed by another. Only the enroll:request that creates the record writes metadata.keyPackage, so repairing either takes an enroll:update the enrollment must send for itself; and a peer verifies the package against _apsk before sealing anything, so a mismatched atSign activates successfully and is then never sent a secret by anyone.

The signing key's algorithm is dataSigningKeyAlgorithms', and it is normally weaker than the authentication key's. The asymmetry is the design: only the atServer verifies the authentication key and it is the operator's own infrastructure, while every peer verifies the signing key and the fleet is not the operator's to upgrade.

keyEstablishmentAlgo is decided at this call, because the builder runs before any client exists; changing it afterwards needs an enroll:update the enrollment must send for itself.

Implementation

Future<PqNativeActivationMaterial> pqNativeActivationMaterial({
  required String atSign,
  required Set<SigningAlgoType> dataSigningKeyAlgorithms,
  String keyEstablishmentAlgo = SecretSharingAlgos.xWing,
}) async {
  final advertisedSigningKey =
      await mintAdvertisedSigningKey(dataSigningKeyAlgorithms);
  return (
    advertisedSigningKey: advertisedSigningKey,
    metadataBuilder: enrollmentKeyPackageBuilder(atSign,
        signingAlgo: SigningAlgoType.mldsa65,
        advertisedSigningKey: advertisedSigningKey,
        keyEstablishmentAlgo: keyEstablishmentAlgo),
  );
}