Summary#
- Add pure functional crypto crate: P-256 key generation, AES-256-GCM encrypt/decrypt at rest, did:key URI derivation (crates/crypto)
- Add admin_token + signing_key_master_key config fields with hex parser and V003 relay_signing_keys migration (crates/common, crates/relay)
- Implement POST /v1/relay/keys with Bearer auth, algorithm validation, master key check, DB persistence; private key never exposed in response
Test Plan#
- cargo test --workspace (122 tests, 0 failures)
- cargo clippy --workspace -- -D warnings (0 warnings)
- cargo fmt --all --check
- Human verification: docs/test-plans/2026-03-11-MM-92.md