feat(xmldsig): add key resolver configuration

[polaz]

Problem

The parsed KeyInfo model and X.509 chain verifier exist, but callers need a configuration-driven resolver for trusted certificates, named verification keys, optional chain verification, verification time, and maximum path depth.

Release automation also renders every conventional commit from a merge-commit PR, so standalone test commits should not become changelog entries.

Implementation

• Add VerificationKey, KeyResolverConfig, DefaultKeyResolver, and typed KeyResolutionError public APIs.
• Pass parsed KeyInfo plus the declared signature algorithm to KeyResolver implementations without reparsing XML.
• Resolve embedded X.509 signing certificates, DSig 1.1 DER-encoded SPKI keys, and configured KeyName entries in document order.
• Validate RSA/EC key compatibility with the declared signature algorithm before verification.
• Enforce configured X.509 trust anchors, verification time, and maximum path depth when verify_chains is enabled.
• Preserve custom resolvers that intentionally ignore malformed advisory KeyInfo.
• Exclude test commits from release-plz changelog output.

Acceptance criteria

• KeyResolverConfig::default() has no trust anchors/named keys, chain verification disabled, system-time selection, and maximum depth 9.
• Embedded X.509, DEREncodedKeyValue, and KeyName sources verify through VerifyContext end to end.
• Algorithm mismatch and untrusted chains fail closed with typed errors.
• Custom resolvers receive parsed optional KeyInfo and the signature algorithm.
• Raw RSA/EC KeyValue remains unresolved until its parser model carries key bytes rather than marker variants.
• Release changelogs omit standalone test commits.
• Workspace fmt, check, clippy, nextest, doc tests, and build pass.

Repository setting follow-up

One changelog entry per PR requires squash-only merges. This repository setting requires explicit owner approval and is not performed by this issue. PR-title validation is intentionally not added to CI.

Estimate

1d 4h: 5h implementation/tests, 2h CI/release validation, 1h review and mentoring overhead.

[coderabbitai]

🔗 Related PRs

#32 - feat(xmldsig): add VerifyContext builder policies [merged]
#47 - feat(xmldsig): add KeyInfo dispatch parsing [merged]
#53 - feat(xmldsig): parse X509Certificate with x509-parser [merged]
#61 - feat(xmldsig): build x509 certificate chains [merged]
#63 - feat(xmldsig): verify x509 certificate chains [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!