Add authority bootstrap flows and Concelier ops runbooks

src/StellaOps.Cryptography.Tests/LibsodiumCryptoProviderTests.cs

@@ -0,0 +1,38 @@
+#if STELLAOPS_CRYPTO_SODIUM
+using System;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading.Tasks;
+using Xunit;
+
+namespace StellaOps.Cryptography.Tests;
+
+public class LibsodiumCryptoProviderTests
+{
+    [Fact]
+    public async Task LibsodiumProvider_SignsAndVerifiesEs256()
+    {
+        var provider = new LibsodiumCryptoProvider();
+        using var ecdsa = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+        var parameters = ecdsa.ExportParameters(includePrivateParameters: true);
+
+        var signingKey = new CryptoSigningKey(
+            new CryptoKeyReference("libsodium-key"),
+            SignatureAlgorithms.Es256,
+            privateParameters: in parameters,
+            createdAt: DateTimeOffset.UtcNow);
+
+        provider.UpsertSigningKey(signingKey);
+
+        var signer = provider.GetSigner(SignatureAlgorithms.Es256, signingKey.Reference);
+
+        var payload = Encoding.UTF8.GetBytes("libsodium-test");
+        var signature = await signer.SignAsync(payload);
+
+        Assert.True(signature.Length > 0);
+
+        var verified = await signer.VerifyAsync(payload, signature);
+        Assert.True(verified);
+    }
+}
+#endif