Sign decision envelopes and close FLEX-WP-0024.

Detached Ed25519 over the canonical envelope with signature omitted. Unsigned is stated, not implied. Testdata fixtures prove verify and tamper failure without minting a production key. FLEX-WP-0025 is finished with the validate check from the previous commit. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-14 09:57:50 +02:00 · 2026-09-14 09:57:50 +02:00 · 127f83da4d
commit 127f83da4d
parent c074237aac
15 changed files with 697 additions and 4 deletions
--- a/examples/caring/decision_envelope.json
+++ b/examples/caring/decision_envelope.json
@ -68,6 +68,9 @@
      "mode": "disabled"
    }
  },
+  "signature": {
+    "mode": "unsigned"
+  },
  "caring": {
    "profile": "caring-0.4.0-rc2",
    "descriptor": {