Sign UK gate reports with Ed25519 so anyone can verify a cut #1406

UK gate reports, release-cut certifications and dense gate reports are signed with HMAC-SHA256. The keys are registered by fingerprint in microcosm.data.gate_signing_keys, from #1405. HMAC is symmetric, so the signature can't do some of what a certificate should. Vahid set out the limits in his review of #1405:

• Verifying needs the secret. Whoever can verify a cut can also sign one. A "certified" cut is its key holder vouching for their own reports. policyengine.py and users downstream rely on Hugging Face write access and the registry, not on a signature they can check.
• Retirement can't be checked. retired_on is only recorded. Whoever still holds a retired key can mint reports that verify.
• Revocation is local. It binds only checkouts and wheels that include the revoking commit.

#1405 documents these limits in docs/uk-cut-anyone.md § Signing keys.

Proposal

Sign with Ed25519 instead. The registry would hold each builder's public key in place of a fingerprint, signers would keep the private key, and anyone with the repository could verify a cut, including policyengine.py at certification time.

Open questions:

• Migration. Keep HMAC verification for the cuts already signed (66bf0e29… and the team key dd31e325…), or re-sign them?
• Dependency. Which library? The standard library has no Ed25519, and the workspace doesn't lock cryptography or PyNaCl today, so this adds one to microcosm-data.
• Retirement. Should verifiers compare a report's signing time with retired_on? That would need a trusted time source, or a signed release log.

🤖 Generated with Claude Code