OTP cryptographic primitives over exact signature-base bytes, for custodians.

Algorithms and encodings follow RFC 9421 Section 3.3, RFC 7518, and RFC 8032.

This low-level boundary returns only signature bytes or mathematical validity. It does not establish trust, identity, policy, or authorization. A custodian calls it inside its secret boundary; private material is never stored in a public key, message, or result. Caller-owned signing functions connect these primitives to RequestSeal.sign/4.

Select an exact identifier from algorithms/0, or explicitly select a supported RFC 9421 Section 3.3.7 extension as {:jws, name}. Extensions are RS256, PS256, PS384, PS512, HS256, ES256, ES384, and Ed25519-only EdDSA. Unknown, case-altered, none, and encryption identifiers reject. JWS names never alias HTTP alg parameters: callers using JWS must omit the HTTP alg parameter and select the extension through trusted configuration/key metadata. These primitives consume the entire base directly, with no JOSE header or Base64 step.

Signing material is an operation-local descriptor: {:rsa, otp_private_key}, {:ec, "P-256" | "P-384", scalar_bytes}, {:ed25519, seed_bytes} (32 bytes), or {:hmac, secret_bytes}. Verification accepts RequestSeal.PublicKey or, only inside the HMAC custodian, {:hmac, secret_bytes}. HMAC secrets must be 32–16,384 bytes for both "hmac-sha256" and {:jws, "HS256"}; there is no key-equivalence derivation. HMAC compares with OTP :crypto.hash_equals/2. HMAC proves shared-secret possession only.

Bases are binaries of at most 1,048,576 bytes. ECDSA uses fixed-width r || s (64/96 bytes), never DER on the wire. RSA-PSS fixes MGF1 to the selected digest and salt length to its digest width (64 for HTTP SHA-512). Ed25519 has no prehash and rejects noncanonical S. RSA signatures have the exact modulus width. Errors are bounded RequestSeal.Crypto.Error values and contain no input bytes.