GenerateKeypair creates a new nix-store compatible keypair rand: uses crypto/rand.Reader if nil name: key identifier used by Nix.

LoadSecretKey decodes a <keyname>:<base64> pair into a SecretKey.

ParsePublicKey decodes a serialized string, and returns a PublicKey struct, or an error.

ParseSignature decodes a <keyname>:<base64-signature-data> and returns a *Signature, or an error.

VerifyFirst returns the result of the first signature that matches a public key.

PublicKey represents a named ed25519 public key.

SecretKey represents a named ed25519 private key.

Signature represents a named ed25519 signature.