nx_jwk.nx

nx_jwk.nx -- JSON Web Key serialization (RFC 7517 + RFC 8037). Closes the JWK gap for ACME (RFC 8555). An ACME account is identified by its public-key JWK; ACME server uses SHA-256(canonical-JWK) as the account-thumbprint. Per cardinal feedback-no-third-party-trust-native-or-nothing: substrate ships its own JWK encoder; no openssl-jose dep. Supported key types (today): OKP / Ed25519 (RFC 8037 §2) -- composes with shipped nx_ed25519_signature Queued (separate slices when needed): EC / P-256 (RFC 7518 §6.2) -- needs nx_p256 RSA / 2048+ (RFC 7518 §6.3) -- needs nx_rsa JWK shape (OKP/Ed25519 public): { "kty": "OKP", "crv": "Ed25519", "x": "<b64url(32B pubkey)>" } Canonical (RFC 7638) thumbprint input: the same JSON with members in lexicographic order, no whitespace between tokens. Substrate emits canonical form by default. nx_capability_claims: needs: [sealed_enum, b64url, json_emit] provides: [jwk_okp_ed25519_emit, jwk_thumbprint_input] safety: [no_unchecked_deref, no_floating_point, no_syscall_other_than_mmap, bit_equal_reproducible, target_agnostic] verdict: [sealed_enum_5_state] license: ORIGINAL kind: racing_crew_specialist layer: L3 (algorithm: encode key per RFC)