cm/pub/

    Public key is the [cm/signed/] structure.
    Stored in a file, it should begin with "cm/pub" [encoding/MAGIC].

    Its "/tbs/t" equals to "pub". "/data" contains:

        pub-data {
            {field . {map}}
            {field id {with fpr}}
            {field crit {} !exists}
            {field ku {set} >0 optional}
            {field pub {list} {of av} >0}
            {field sub {map} {of type str} >0}
        }

    sub:
        Subject is a map of arbitrary strings. Currently no constraints on
        what fields must be present. Each application defines them on its
        own. But you may mimic X.509's subject with keys like "CN", "C", "O"
        and similar ones.
    pub:
        Public key container itself may contain multiple public keys.
        That is *solely* intended for tasks requiring more than single
        key usage. For example NNCP uses one X25519 for (DH) encryption, one
        X25519 for online authentication and one ed25519 for signing purposes.
        All those three keys are used together. That public key's key usage
        field should contain something like "nncp".
        => NNCP
        If your keypair is intended for general purposes like signing of
        arbitrary data, then single public key *should* be used, with a key
        usage like "sig".
    id:
        Public key(s)'s fingerprint *should* be generated as 256-bit
        hash over the encoded "pub" field, if not stated otherwise for
        specific algorithm. Exact hash algorithm depends on the public keys.
    ku:
        Intended public key(s) usage.
        Application-specific example with multiple public keys is described
        above. It *must* be absent if empty.
    crit:
        Optional critical (in terms of X.509) extensions. Non-critical
        ones may be placed outside that map, directly in /data.
        It *must* be absent if empty. Values are extension specific.

    [cm/signed/]'s "tbs" *must* contain additional fields:

        exp-tai {{field . {tai} prec=s utc}}
        expiration {{field . {list} {of exp-tai} len=2}}

        pub-sig-tbs {
            {field . {map}}
            {field sid {with fpr}}
            {field cid {hexlet}}
            {field exp {with expiration}}
            {field nonce {bin} >0 optional}
            {field when {tai} utc prec=ms optional}
        }

    sid: Signing public key's fingerprint.
    cid: Certification unique identifier. UUIDv7 is a good choice.
         But it may be UUIDv4, or any desired method of generation.
    exp: Certification expiration period.

    Example minimal certified public key may look like:

        MAGIC cm/pub
        MAP {
          tbs {MAP {
            t {STR pub}
          }}
          data {MAP {
            id {BIN "6aee..."}
            pub {LIST {
              {MAP {
                a {STR ed25519-blake2b}
                v {BIN "c1bf..."}
              }}
            }}
            sub {MAP {
              N {STR test}
            }}
          }}
          sigs {LIST {
            {MAP {
              tbs {MAP {
                cid {HEXLET 01963308-1033-75a7-bfb6-7d3ab3db6d63}
                exp {LIST {
                  {TAI64 "2025-04-14 06:41:28"}
                  {TAI64 "2026-04-14 06:41:28"}
                }}
                sid {BIN "0087..."}
              }}
              sign {MAP {
                a {STR ed25519-blake2b}
                v {BIN "7450..."}
              }}
            }}
          }}
        }

            Backlinks:
      0 [cm/]                                                              0
      1 [cm/encrypted/]                                                    0
      2 [cm/pub/ed25519-blake2b]                2025-09-29 08:25:34       10
      3 [cm/pub/gost3410]                       2025-09-29 08:25:34        4
      4 [cm/pub/mceliece6960119-x25519]         2025-09-29 08:25:34       18
      5 [cm/pub/slh-dsa-shake-256s]             2025-09-29 08:25:34        5
      6 [cm/pub/sntrup761-x25519]               2025-09-29 08:25:34       14
      7 [cm/signed/]                                                       0
      8 [schema/tcl]                            2025-09-29 08:25:34      134