feat(keys): add caller-owned key inventory

.github/workflows/ci.yml

@@ -71,7 +71,7 @@ jobs:
             xml-backend: fat-runtime
             cargo-args: --no-default-features --features xmldsig,xmlenc,c14n,xml-backends-all
           - rust: stable
-            xml-backend: xmlenc-only
+            xml-backend: xmlenc-inventory
             cargo-args: --no-default-features --features xmlenc,xml-backend-xmloxide
           - rust: "1.92.0"
             xml-backend: xmloxide

Cargo.toml

@@ -106,6 +106,8 @@ cbc = { version = "0.2.1", optional = true }
 des = { version = "0.9", optional = true }
 md-5 = { version = "0.11", optional = true }
 pem = { version = "4", optional = true }
+pkcs12 = { version = "=0.2.0-pre.0", default-features = false, features = ["kdf"], optional = true }
+pbkdf2 = { version = "0.13", default-features = false, features = ["hmac"], optional = true }
 
 # X.509 certificates
 x509-parser = { version = "0.18", features = ["verify"], optional = true }
@@ -152,6 +154,10 @@ xmldsig = [            # XML Digital Signatures (sign + verify)
     "dep:hmac",
     "dep:md-5",
     "dep:pem",
+    "dep:pkcs12",
+    "dep:pbkdf2",
+    "dep:aes",
+    "dep:cbc",
     "dep:peresil",
     "dep:p256",
     "dep:p384",
@@ -171,6 +177,8 @@ xmldsig = [            # XML Digital Signatures (sign + verify)
 ]
 xmlenc = [             # XML Encryption (encrypt + decrypt)
     "std",
+    # The shared key inventory stores XMLDSig KeyInfo for named RSA recipients.
+    "xmldsig",
     "dep:aes",
     "dep:aes-gcm",
     "dep:aes-kw",

README.md

@@ -59,6 +59,7 @@ xml-sec = { version = "0.1", default-features = false, features = ["xmldsig", "c
 | XML signatures | XMLDSig signing and verification, RSA/DSA/ECDSA/HMAC, XPath transforms, `Manifest`, `KeyInfo`, and caller-provided references |
 | XML encryption | AES-CBC/GCM, RSA-OAEP, AES Key Wrap, multiple recipients, and Element/Content replacement |
 | X.509 | Certificate key extraction, chain validation, CRLs, and policy-controlled trust |
+| Key management | Caller-owned named inventory, usage-restricted keys, xmlsec `keys.xml`, encrypted PKCS#8, and bounded RustCrypto-backed PKCS#12 import |
 | SAML 2.0 | Signed assertions and encrypted-assertion workflows covered by integration tests |
 | XML input | Strict bounded byte decoding, entity/depth/node limits, stable node identities, and generation-safe mutation |
 | Crypto | Provider-neutral contracts and opaque key handles with pure-Rust RustCrypto as the default implementation |
@@ -83,6 +84,8 @@ The signing and verification pipelines support same-document and caller-provided
 XPath 1.0 and XPath Filter 2 transforms, `Manifest`, structured `KeyInfo`, and policy-controlled
 X.509 validation. See [XML Digital Signatures](docs/xmldsig.md) for algorithms, transform semantics,
 key resolution, failure handling, and current interoperability boundaries.
+See [Key management](docs/key-management.md) for inventory ownership, format import,
+password handling, and CLI key-store behavior.
 
 ## XML Encryption
 
@@ -104,6 +107,9 @@ fn example() -> Result<(), Box<dyn std::error::Error>> {
 }
 ```
 
+RSA encryption and decryption default to a 2048-bit minimum. Applications accepting legacy
+keys must explicitly select a lower operation-policy minimum; importing a key does not bypass it.
+
 See [XML Encryption](docs/xmlenc.md) for reciprocal decryption, key transport, recipient selection,
 document replacement, and parser policy.
 

crates/xml-sec-xslt/src/model.rs

@@ -1399,7 +1399,6 @@ impl Document {
         Ok(())
     }
 
-    #[must_use]
     pub fn nodes(&self) -> impl ExactSizeIterator<Item = (NodeId, &Node)> {
         self.nodes
             .iter()

docs/cli.md

@@ -185,6 +185,18 @@ headers, or DER structure select encrypted versus plain decoding first: a
 supplied password is ignored for a plain key, while a missing or wrong password
 for an encrypted key fails without a plaintext fallback, before output is
 committed, and is never included in diagnostics.
+`--keys-file FILE` imports a bounded xmlsec `keys.xml` store for sign, verify,
+encrypt, and decrypt. Named HMAC/DSA signers, named HMAC/RSA/EC public
+verification keys, direct AES content keys, and RSA-OAEP encryption recipients are selected
+from the same caller-owned inventory; an imported key never bypasses the
+operation policy. XML `RSAKeyValue` entries are public-only and cannot recover
+an encrypted recipient key; use `--privkey-pem`, `--privkey-der`, or `--pkcs12`
+for RSA decryption. `--pkcs12[:NAME] FILE --pwd PASSWORD` supplies one private
+key and its certificate chain for sign or RSA decryption. Bundles with multiple
+private keys are rejected rather than selecting an arbitrary bag. Neither
+option triggers network lookup or implicit key discovery. See
+[Key management](key-management.md) for the byte-oriented library API and trust
+model.
 
 Verification accepts `-` as the conventional stdin marker. Verification starts
 at the document root and uses the first descendant `Signature` in document order.
@@ -266,6 +278,9 @@ a different recipient. Selector-only `X509Data` (`X509SubjectName`,
 supplied through `--pubkey-cert-pem` or `--pubkey-cert-der`; a bare public key
 cannot satisfy certificate identity metadata. `KeyName` remains a lookup hint
 and empty `X509Data` remains a non-binding placeholder.
+All nested recipient `KeyInfo` elements share the operation's embedded-key,
+X.509 binary-data, and XML Base parsing allowances; each recipient does not
+receive a fresh default limit. Candidate limits are checked before decoding.
 For `--xml-data`, a missing template `Type` is materialized as XML Element
 metadata so a later embedded-document decrypt can perform XML replacement. As
 in libxmlsec1, the input is parsed as an XML document: Element encryption