Behaviour for signing operations in the SIGIL protocol.

Implementations produce Ed25519 signatures over canonical envelope bytes. The two required callbacks are sign/1 and public_key/0.

Usage

Pass your signer module to envelope operations:

SigilGuard.sign_envelope("did:sigil:example", :allowed,
  signer: MyApp.HsmSigner
)

Implementing a Custom Signer

Any module implementing this behaviour can be used for envelope signing. Common use cases include HSM-backed keys, cloud KMS, or hardware tokens:

defmodule MyApp.HsmSigner do
  @behaviour SigilGuard.Signer

  @impl true
  def sign(message) do
    # Sign via HSM or KMS
    MyHsm.sign(:ed25519, message)
  end

  @impl true
  def public_key do
    MyHsm.public_key(:ed25519)
  end
end

Keypair Generation

For development and testing, use generate_keypair/0 to create an ephemeral Ed25519 keypair:

{pub, priv} = SigilGuard.Signer.generate_keypair()