Module operator_keys 

The operator key trust set, loaded from [[operator_keys]].

Two subsystems verify detached Ed25519 signatures against one shared set of operator keys: the topic write-freeze registry and the break-glass approval workflow. Both reach the keys through OperatorKeys, so an operator is provisioned once and a signature is checked one way.

OperatorKeys::load reads every configured public key file, so an unreadable path or a malformed key stops the broker at boot instead of in the middle of an incident. Verification calls crate::signing::verify_signature, the same code path that checks an audit checkpoint, so operator key material has the shape the audit checkpoint keys already have.

This module holds no canonical-bytes builder. The freeze subsystem and the break-glass subsystem each define their own signed payload, under their own domain separator, and pass the finished bytes to OperatorKeys::verify.

Structs

OperatorKey

One loaded operator key and the principal it is bound to.

OperatorKeyEntry

One [[operator_keys]] entry, before its public key file is read.

OperatorKeys

The loaded, validated operator key trust set.

Enums

OperatorKeyError

Failures that stop OperatorKeys::load, and with it the broker.

Functions

approver_set_fingerprint

SHA-256 hex fingerprint of a configured approver set.