test(xmldsig): verify generated signatures with xmlsec1

[polaz]

Problem

The signing pipeline is covered by internal round-trip tests, but it is not yet verified by an independent XMLDSig implementation.

Scope

• Sign RSA-SHA256, ECDSA P-256/SHA-256, and ECDSA P-384/SHA-384 documents through the public signing API.
• Verify each generated document with the xmlsec1 command-line verifier and its matching public key.
• Prove that the external verifier rejects a tampered signed payload.
• Install xmlsec1 in CI so the interoperability contract is mandatory.

Acceptance Criteria

• External verification succeeds for all supported signing algorithms above.
• A modified signed payload is rejected by xmlsec1.
• CI runs the interop tests on every supported Rust toolchain.

Validation

• cargo nextest run --all-features
• cargo test --doc --all-features

[coderabbitai]

🔗 Related PRs

#27 - feat(xmldsig): add ecdsa signature verification [closed]
#30 - feat(xmldsig): add full signature verify pipeline [closed]
#41 - test(xmldsig): add donor full verification suite accounting [closed]
#72 - feat(xmldsig): resolve X509 selectors [merged]
#77 - feat(xmldsig): add XML mutation strategy [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!