@blamejs/pki 0.8.4 → 0.8.6

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.6 — 2026-09-25
+
+A node:crypto KeyObject signs, without being asked to export its private half.
+
+### Added
+
+- A `node:crypto` `KeyObject` is accepted wherever a signing verb takes a private key, and signs through `node:crypto` rather than being exported to PKCS#8 first. RSA with PKCS#1 v1.5 and with PSS padding, ECDSA on P-256, P-384 and P-521, Ed25519, Ed448, ML-DSA and SLH-DSA all sign this way, and the bytes produced are the bytes WebCrypto would have produced: an ECDSA signature is taken in the fixed-width form of RFC 9053 sec. 2.1 and encoded by the toolkit, so the artifact is byte-identical to one signed by the equivalent `CryptoKey`.
+- A `KeyObject` is held to the key the artifact names exactly as a `CryptoKey` is. Its algorithm must match the certificate's key algorithm and, for an EC key, its curve must match the certificate's curve; a public or a secret key is refused by type; and the signature is verified against the declared key before the artifact is returned, so a `KeyObject` for a different key of the same algorithm is refused rather than producing something no relying party can validate.
+
+### Changed
+
+- `pki.x509.sign` and the other signing verbs no longer refuse a `node:crypto` `KeyObject` with the message naming it as not a `CryptoKey`. A caller matching on that message to detect the refusal will stop seeing it, because the key now signs.
+
+## v0.8.5 — 2026-09-25
+
+A key this process cannot export can sign, and every verb that signs proves its signature first.
+
+### Added
+
+- A signer `{ algorithm, publicKey, sign }` is accepted wherever a signing verb takes a private key: `pki.x509.sign`, `pki.crl.sign`, `pki.csr.sign`, `pki.cms.sign` and its countersignatures, `pki.attrcert.sign`, `pki.cmp.build`, `pki.crmf.build`, `pki.ocsp.buildRequest`, `pki.ocsp.sign` and `pki.tsp.sign`. `sign(bytes)` is handed the bytes WebCrypto would be handed and returns the bytes WebCrypto would return, or a promise of them; for ECDSA that is the fixed-width `r || s` of RFC 9053 sec. 2.1, and a DER `SEQUENCE` is refused by name rather than encoded a second time. The private half never reaches the toolkit.
+- A signer's declared `algorithm` is held to the algorithm of the key the artifact certifies, and its declared `publicKey` to the key the signature is verified against, both before the callback is asked to sign. The caller's object is read once, in the synchronous prologue, so an accessor cannot answer one way to the check and another to the use. For an ECDSA key, whose curve is named but whose digest is chosen per signature, the digest the signer declares is checked on its own, before any remote signing request. The bytes the callback is handed are a copy in an allocation of its own, so a callback that rewrites them rewrites only its own copy and cannot reach the bytes the artifact carries. The bytes it returns are copied before use. Hold a client or any mutable state in the callback's closure: a signing verb snapshots its options, so the signer object the callback sees is a copy of the one you passed. A composite ML-DSA signature is refused by name, since it is produced from both component private keys and one callback cannot do that.
+
+### Fixed
+
+- `pki.ocsp.sign`, `pki.ocsp.buildRequest` and `pki.cms.sign`'s countersignature path verify the signature they produced against the public key the artifact declares, which the other signing verbs already did. A signer holding a key that does not match the certificate it signs under produced an OCSP response, an OCSP request or a countersignature that no relying party could validate, and the emitting side reported success.
+
 ## v0.8.4 — 2026-09-25
 
 A decode cap bounds every structure a parse reads, and a refusal caused by a cap is no longer reported as malformed input.

package/README.md

@@ -190,6 +190,41 @@ var ok  = await subtle.verify({ name: "ML-DSA-65" }, kp.publicKey, sig, data); /
 // same call shape, and every key it exports is OpenSSL/NSS-interoperable.
 ```
 
+### Sign with a key this process cannot export
+
+Every signing verb takes a `node:crypto` `KeyObject` wherever it takes a private
+key, and signs through `node:crypto`, so a key an OpenSSL engine or provider
+refuses to export still signs.
+
+```js
+var keyObject = crypto.createPrivateKey({ key: pem });
+var cert = await pki.x509.sign(spec, { key: keyObject, cert: caCert });
+```
+
+For a key that is not in this process at all, held in a hardware security module,
+a cloud key management service, a PKCS#11 token, a PIV slot or a Trusted Platform
+Module, every signing verb takes a signer object in the same place.
+
+```js
+var signer = {
+  algorithm: { name: "ECDSA", namedCurve: "P-256", hash: { name: "SHA-256" } },
+  publicKey: spkiDer,                       // the SPKI DER of the public half
+  sign: function (bytes) { return kms.sign(keyId, bytes); },   // bytes or a promise of them
+};
+
+var cert = await pki.x509.sign(spec, { key: signer, cert: caCert });
+```
+
+`sign(bytes)` is handed the bytes WebCrypto would be handed and returns the bytes
+WebCrypto would return: for ECDSA the fixed-width `r || s` of RFC 9053 §2.1, not a
+DER `SEQUENCE`. `algorithm` is held to the certificate's key algorithm, `publicKey`
+is held to the key the signature is verified against, and the signature is
+verified before the artifact is returned. The bytes handed to the callback are a
+copy, so rewriting them rewrites nothing the artifact carries. Hold the client and
+any mutable state in the callback's closure, as the example does: a signing verb
+snapshots its options, so the signer object the callback sees is a copy of the one
+you passed.
+
 ## What ships today
 
 Everything below is callable now; nothing is a stub. The whole documented

package/lib/cms-sign.js

@@ -214,7 +214,10 @@ function _keyOnlyCertStandIn(spkiDer) {
     if (e && typeof e.code === "string" && e.code.indexOf("cms/") === 0) throw e;
     throw _err("cms/bad-input", "a key-only signer's spki is not a SubjectPublicKeyInfo", e);
   }
-  return { subjectPublicKeyInfo: { algorithm: alg } };
+  /** @internal The SPKI bytes travel with the stand-in, because the key this signature is verified
+   * against is what a signer's declared publicKey is held to, and this form names that key by SPKI
+   * rather than by certificate. */
+  return { subjectPublicKeyInfo: { bytes: spkiDer, algorithm: alg } };
 }
 
 function _keyOnlyKeyId(so) {
@@ -432,11 +435,18 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
       return _buildSignedAttrs(pairs.concat(extra));
     });
   }).then(function (attrs) {
-    return signScheme.signOverTbs(scheme, soKey, attrs ? attrs.setOf : targetSigOctets, _signE).then(function (sig) {
-      var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
-      if (attrs) fields.push(attrs.wire);
-      fields.push(scheme.sigAlgId, b.octetString(sig));
-      return { value: b.sequence(fields), certDer: certDer };
+    var preimage = attrs ? attrs.setOf : targetSigOctets;
+    return signScheme.signOverTbs(scheme, soKey, preimage, _signE).then(function (sig) {
+      /** @internal The countersignature is held to the same proof the signature is: it verifies
+       * against the public key the countersigner's certificate declares. */
+      return guard.async.deferred(function () {
+        return _b.assertSignatureVerifies(preimage, sig, cert.subjectPublicKeyInfo.bytes, scheme);
+      }).then(function () {
+        var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];
+        if (attrs) fields.push(attrs.wire);
+        fields.push(scheme.sigAlgId, b.octetString(sig));
+        return { value: b.sequence(fields), certDer: certDer };
+      });
     });
   });
 }

package/lib/cms-verify.js

@@ -721,7 +721,8 @@ function _addCert(out, der) {
  * S/MIME signed mail, RFC 3161 timestamp tokens, and code signing rest on, and exactly what
  * `pki.cms.verify` consumes and OpenSSL `cms -verify` validates. Each `signers[i]` is
  * `{ cert, key, digestAlgorithm?, pss? }`: `cert` the signer certificate (PEM or DER), `key`
- * its private key (a WebCrypto `CryptoKey` or a PKCS#8 DER `Buffer` / PEM string; for a composite
+ * its private key (a WebCrypto `CryptoKey`, a PKCS#8 DER `Buffer` / PEM string, or a signer
+ * `{ algorithm, publicKey, sign }` for a key held outside this process; for a composite
  * ML-DSA signer, the two component keys `{ mldsa, trad }`, each PKCS#8). The
  * signature covers the RFC 5652 sec. 5.4 preimage: with signed attributes (the default) the
  * message-digest attribute is bound to the content digest and the signature is over the

package/lib/csr-sign.js

@@ -77,7 +77,8 @@ function _challengePassword(pw) {
  * `challengePassword`. An extension the issuing CA assigns (authorityKeyIdentifier, the
  * certificate-transparency pair, the CA version and previous-certificate hash, ocspNoCheck) is not a
  * request and is refused by name. `key` (or
- * `{ key }`) is the subject's own PKCS#8 private key / WebCrypto CryptoKey, so the request is self-signed
+ * `{ key }`) is the subject's own PKCS#8 private key, WebCrypto CryptoKey, or signer
+ * `{ algorithm, publicKey, sign }`, so the request is self-signed
  * to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the
  * request is returned. The signature algorithm is resolved from the subject key (RSA PKCS#1 v1.5 or PSS,
  * ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). Returns DER, or a PEM `CERTIFICATE REQUEST` with

package/lib/ocsp.js

@@ -45,6 +45,9 @@ var b = asn1.build;
 function O(name) { return oid.byName(name); }
 function _err(code, message, cause) { return new OcspError(code, message, cause); }
 function _signE(kind, message, cause) { return new OcspError("ocsp/" + kind, message, cause); }
+/** @internal Only the signature self-check is taken from the shared builder here; the name and
+ * SPKI schemas it also serves belong to the certificate verbs, and this module reads neither. */
+var _b = pkiBuild.makeBuilder({ ErrorClass: OcspError, prefix: "ocsp", O: O, NS: null, NAME_SCHEMA: null, SPKI_SCHEMA: null, EXT_DECODERS: {} });
 
 var HASH_WC = Object.assign(Object.create(null), { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var REASON_CODE = Object.create(null);
@@ -214,8 +217,12 @@ function _buildRequest(query, opts) {
     if (signerCert === null) return _emitReq(b.sequence([tbsRequest]), opts);
     var scheme = signScheme.resolveSignScheme(signerCert, { combinedRsaSig: true }, true, _signE);
     return signScheme.signOverTbs(scheme, opts.signer.key, tbsRequest, _signE).then(function (sig) {
-      var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
-      return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
+      /** @internal The request is held to the same proof a certificate is: the signature verifies
+       * against the public key the certificate it carries declares. */
+      return Promise.resolve(_b.assertSignatureVerifies(tbsRequest, sig, signerCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+        var optionalSignature = b.sequence([scheme.sigAlgId, b.bitString(sig, 0), b.explicit(0, b.sequence([b.raw(signerCertDer)]))]);
+        return _emitReq(b.sequence([tbsRequest, b.explicit(0, optionalSignature)]), opts);
+      });
     });
   });
 }
@@ -349,11 +356,15 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       var responseDataDer = b.sequence(rdChildren);
       var scheme = signScheme.resolveSignScheme(respCert, { combinedRsaSig: true }, true, _signE);
       return signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE).then(function (sig) {
-        var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
-        if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
-        var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
-        var der = b.sequence([b.enumerated(0n), b.explicit(0, responseBytes)]);
-        return opts.pem ? ocspSchema.pemEncode(der, "OCSP RESPONSE") : der;
+        /** @internal The response is held to the same proof a certificate is: the signature verifies
+         * against the public key the responder certificate declares. */
+        return Promise.resolve(_b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme)).then(function () {
+          var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
+          if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
+          var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
+          var der = b.sequence([b.enumerated(0n), b.explicit(0, responseBytes)]);
+          return opts.pem ? ocspSchema.pemEncode(der, "OCSP RESPONSE") : der;
+        });
       });
     });
   });

package/lib/pki-build.js

@@ -1290,7 +1290,7 @@ function makeBuilder(ctx) {
     var keyOid;
     try { keyOid = asn1.read.oid(alg.children[0]); }
     catch (e) { throw E("bad-input", "the signing key SPKI algorithm is not an OID", e); }
-    return { subjectPublicKeyInfo: { algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
+    return { subjectPublicKeyInfo: { bytes: spkiDer, algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
   }
 
   function assertSignatureVerifies(preimage, sig, spki, scheme) {

package/lib/sign-scheme.js

@@ -5,7 +5,10 @@
 
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
+var nodeCrypto = require("crypto");
 var pkcs8 = require("./schema-pkcs8");
+var pkix = require("./schema-pkix");
+var frameworkError = require("./framework-error");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
@@ -20,9 +23,11 @@ var _String = intrinsic.String;
 var _filter = intrinsic.filter;
 var _stringify = intrinsic.stringify;
 var _toUpperCase = intrinsic.toUpperCase;
+var _toLowerCase = intrinsic.toLowerCase;
 var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isU8 = intrinsic.types.isUint8Array;
+var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 
 var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
@@ -98,7 +103,17 @@ function pssSpkiPinnedHash(cert, E) {
   return HASH[d];
 }
 
+/** @internal The SPKI the signature will be verified against travels on the scheme, because the
+ *  signer form declares a public key and the door has to hold it to the one the certificate names.
+ *  Attached here rather than on each return, so a new algorithm branch cannot omit it. */
 function resolveSignScheme(cert, so, noSignedAttrs, E) {
+  var scheme = _resolveSignScheme(cert, so, noSignedAttrs, E);
+  var spki = cert && cert.subjectPublicKeyInfo;
+  scheme.spki = (spki && spki.bytes) || null;
+  return scheme;
+}
+
+function _resolveSignScheme(cert, so, noSignedAttrs, E) {
   so = so || {};
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
@@ -154,15 +169,16 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
   throw E("unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
 }
 
-function _assertKeyMatchesScheme(key, imp, E) {
+function _assertKeyMatchesScheme(key, imp, E, what) {
   var ka = key.algorithm || {};
+  var subject = what || "CryptoKey";
   if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) {
     var hint = (_toUpperCase(_String(ka.name)) === "RSA-PSS" && _toUpperCase(_String(imp.name)) === "RSASSA-PKCS1-V1_5")
-      ? "; this CryptoKey is bound to RSASSA-PSS -- pass opts.pss to sign with RSASSA-PSS" : "";
-    throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")" + hint);
+      ? "; this " + subject + " is bound to RSASSA-PSS -- pass opts.pss to sign with RSASSA-PSS" : "";
+    throw E("bad-input", "the signer " + subject + " algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")" + hint);
   }
-  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
-  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
+  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer " + subject + " hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
+  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer " + subject + " curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
 /** @internal `owned`, when given, collects the copies this makes of the caller's key so the caller can
  * wipe them: a Buffer is viewed and stays the caller's, while a Uint8Array or a PEM string produces a
@@ -204,9 +220,10 @@ function _importKey(key, imp, E) {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }
     owned = true;
-  } else if (intrinsic.types.isKeyObject(key)) {
-    throw E("bad-input", "the signing key is a node:crypto KeyObject, not a WebCrypto CryptoKey; pass a CryptoKey (e.g. from pki.key.generate) or export it to a PKCS#8 DER Buffer or PEM string");
-  } else throw E("bad-input", "a signer key must be a WebCrypto CryptoKey, a PKCS#8 DER Buffer, or a PKCS#8 PEM string");
+  } else {
+    throw E("bad-input", "a signer key must be a WebCrypto CryptoKey, a node:crypto KeyObject, a PKCS#8 DER Buffer, " +
+      "a PKCS#8 PEM string, or a signer { algorithm, publicKey, sign }");
+  }
   var imported = subtle.importKey("pkcs8", der, imp, false, ["sign"]);
   if (!owned) return imported;
   return imported.then(function (k) {
@@ -218,7 +235,181 @@ function _importKey(key, imp, E) {
   });
 }
 
+/** @internal The signer form, read ONCE. A caller's object is not asked the same question twice:
+ *  an accessor that answers differently on a second read would let the algorithm the door checked
+ *  differ from the one that signs, and the callback the door validated differ from the one it
+ *  calls. `sign` doubles as the discriminator, so the read that classifies is the read that runs. */
+function _snapshotSigner(key) {
+  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key)) return null;   // allow:byte-source-narrow -- signer-form discrimination: a raw-key BufferSource is correctly classed as not a signer and normalized by _importKey
+  var sign = key.sign;
+  if (typeof sign !== "function") return null;
+  var algorithm = key.algorithm;
+  if (typeof algorithm === "string") algorithm = { name: algorithm };
+  var flat = null;
+  if (algorithm != null && typeof algorithm === "object") {
+    var hash = algorithm.hash;
+    var hashName = typeof hash === "string" ? hash : (hash == null ? undefined : hash.name);
+    flat = {
+      name: algorithm.name,
+      hash: hashName === undefined ? undefined : { name: hashName },
+      namedCurve: algorithm.namedCurve,
+    };
+  }
+  /** @internal `receiver` is the object this door was handed, so `sign` is called on it and plain
+   *  configuration read off `this` answers. A signing verb snapshots its options, so a client or a
+   *  counter a signer holds on itself is a copy by the time it arrives; a callback keeps those in
+   *  its closure instead, which is where the documented examples put them. */
+  return { sign: sign, receiver: key, algorithm: flat, publicKey: key.publicKey };
+}
+
+/** @internal An SPKI a signer declares, from the shapes a public key arrives in. */
+function _signerSpki(publicKey, E) {
+  if (typeof publicKey === "string") {
+    try { return pkix.pemDecode(publicKey, "PUBLIC KEY", frameworkError.PemError); }
+    catch (e) { throw E("bad-input", "the signer publicKey PEM could not be decoded", e); }
+  }
+  return guard.bytes.snapshotSource(publicKey, E, "bad-input", "the signer publicKey");
+}
+
+/** @internal The signature a signer returned, held to the contract the callback is documented
+ *  against: the bytes `subtle.sign` would return for this scheme. An ECDSA signature is the
+ *  fixed-width r||s of RFC 9053 sec. 2.1, and the DER SEQUENCE a token usually emits is named
+ *  rather than re-derived, because guessing which encoding arrived is how one gets converted twice. */
+function _assertSignerSignature(sig, scheme, E) {
+  if (!scheme.ecdsaDer) return sig;
+  var want = scheme.coordLen * 2;
+  if (sig.length === want) return sig;
+  if (sig.length > 1 && sig[0] === 0x30) {
+    throw E("bad-input", "the signer returned a DER SEQUENCE for an ECDSA signature; sign() returns the " +
+      want + "-byte r||s a WebCrypto signature carries (RFC 9053 sec. 2.1), and this toolkit encodes it");
+  }
+  throw E("bad-input", "the signer returned " + sig.length + " byte(s) for an ECDSA signature on this curve; " +
+    "sign() returns the " + want + "-byte r||s a WebCrypto signature carries (RFC 9053 sec. 2.1)");
+}
+
+function _signExternally(signer, scheme, signedBytes, E) {
+  if (scheme.composite) {
+    throw E("bad-input", "a composite " + scheme.composite.name + " signature is produced from both component private keys, " +
+      "which one sign() callback cannot do; pass { mldsa, trad } PKCS#8 keys");
+  }
+  if (signer.algorithm == null) throw E("bad-input", "a signer must declare the algorithm it signs with: { algorithm, publicKey, sign }");
+  if (signer.publicKey == null) throw E("bad-input", "a signer must declare its publicKey as SPKI DER, so the door can hold it to the key the signature is verified against");
+  _assertKeyMatchesScheme(signer, scheme.imp, E, "signer");
+  /** @internal The digest a scheme signs under is not always part of the key's import parameters:
+   *  an ECDSA key names only its curve, and the digest is chosen per signature. A signer declares
+   *  what it will do, so it is held to that here rather than after a remote signing request. */
+  var wantHash = scheme.sign && scheme.sign.hash;
+  if (wantHash && signer.algorithm.hash && signer.algorithm.hash.name !== wantHash) {
+    throw E("bad-input", "the signer algorithm hash (" + signer.algorithm.hash.name +
+      ") does not match the signing digest (" + wantHash + ")");
+  }
+  var declared = _signerSpki(signer.publicKey, E);
+  if (!scheme.spki) throw E("bad-input", "this signing path does not name the public key a signature is verified against, so a signer's publicKey cannot be held to it");
+  var named = guard.bytes.snapshotSource(scheme.spki, E, "bad-input", "the public key this signature is verified against");
+  if (!guard.crypto.constantTimeEqual(declared, named)) {
+    throw E("bad-input", "the signer publicKey is not the key this signature is verified against");
+  }
+  /** @internal The callback is handed a COPY, in an allocation of its own. It is a caller's
+   *  function over the bytes an artifact is built from, and a callback that rewrote them in place
+   *  would rewrite what is verified and what is emitted together, so the self-check would pass on
+   *  the rewritten artifact. `Buffer.from` is not enough: a small copy comes out of Node's shared
+   *  pool, whose backing ArrayBuffer the callback could reach the original through. */
+  var handed = new intrinsic.Uint8Array(signedBytes.length);
+  handed.set(signedBytes);
+  var produced;
+  try { produced = intrinsic.apply(signer.sign, signer.receiver, [handed]); }
+  catch (e) { throw E("bad-input", "the signer sign() callback failed", e); }
+  return _resolve(Promise, produced).then(function (raw) {
+    var sig = guard.bytes.snapshotSource(raw, E, "bad-input", "the signature the signer returned");
+    return _assertSignerSignature(sig, scheme, E);
+  }, function (e) {
+    throw E("bad-input", "the signer sign() callback failed", e);
+  });
+}
+
+/** @internal What `node:crypto` calls the key an algorithm the toolkit signs with uses, keyed by
+ *  the WebCrypto name the scheme resolved to. The two vocabularies differ, and the map is the one
+ *  place that knows it, so a new algorithm adds a row rather than a branch. */
+var NODE_KEY_TYPE = intrinsic.assign(intrinsic.create(null), {
+  "RSASSA-PKCS1-v1_5": "rsa", "RSA-PSS": "rsa-pss", ECDSA: "ec", Ed25519: "ed25519", Ed448: "ed448",
+});
+/** @internal The curve a KeyObject reports, keyed by the WebCrypto curve a scheme names. */
+var NODE_CURVE = intrinsic.assign(intrinsic.create(null), {
+  "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1",
+});
+
+/** @internal An RSA key carries no padding in its type, so an RSA-PSS scheme signs with a plain
+ *  `rsa` key too; the padding is named on the signature, not on the key. */
+function _keyTypeAccepts(reported, wanted) {
+  if (reported === wanted) return true;
+  return wanted === "rsa-pss" && reported === "rsa";
+}
+
+function _assertKeyObjectMatchesScheme(key, scheme, E) {
+  var reported = key.asymmetricKeyType;
+  var wanted = NODE_KEY_TYPE[scheme.imp.name] || _toLowerCase(_String(scheme.imp.name));
+  if (!_keyTypeAccepts(reported, wanted)) {
+    throw E("bad-input", "the signer KeyObject algorithm (" + reported +
+      ") does not match the certificate's key algorithm (" + scheme.imp.name + ")");
+  }
+  if (scheme.imp.namedCurve) {
+    var details = key.asymmetricKeyDetails;
+    var curve = details && details.namedCurve;
+    if (curve !== NODE_CURVE[scheme.imp.namedCurve]) {
+      throw E("bad-input", "the signer KeyObject curve (" + curve +
+        ") does not match the certificate curve (" + scheme.imp.namedCurve + ")");
+    }
+  }
+}
+
+/** @internal The options `node:crypto` signs a scheme under, so the bytes it returns are the bytes
+ *  WebCrypto would have returned: an ECDSA signature in the fixed-width form of RFC 9053 sec. 2.1,
+ *  which the caller then encodes, and a PSS signature at the salt length the scheme fixed. */
+function _nodeSignOptions(key, scheme) {
+  var name = scheme.sign.name;
+  if (name === "ECDSA") return { key: key, dsaEncoding: "ieee-p1363" };
+  if (name === "RSA-PSS") {
+    return { key: key, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: scheme.sign.saltLength };
+  }
+  return key;
+}
+
+/** @internal A digest `node:crypto` applies before signing. An algorithm that hashes the message
+ *  itself (the Edwards curves, ML-DSA, SLH-DSA) takes none, and naming one there is an error. */
+function _nodeDigest(scheme) {
+  var name = scheme.sign.name;
+  if (name === "ECDSA" || name === "RSA-PSS" || name === "RSASSA-PKCS1-v1_5") return NODE_DIGEST[scheme.digest] || scheme.digest;
+  return null;
+}
+
+function _signWithKeyObject(key, scheme, signedBytes, E) {
+  if (scheme.composite) {
+    throw E("bad-input", "a composite " + scheme.composite.name + " signature is produced from both component private keys, " +
+      "which one KeyObject cannot hold; pass { mldsa, trad } PKCS#8 keys");
+  }
+  if (key.type !== "private") {
+    throw E("bad-input", "the signing key is a node:crypto KeyObject of type " + _stringify(key.type) +
+      "; a signing key must be a private key (type \"private\")");
+  }
+  _assertKeyObjectMatchesScheme(key, scheme, E);
+  try {
+    return _bufferFrom(nodeCrypto.sign(_nodeDigest(scheme), signedBytes, _nodeSignOptions(key, scheme)));
+  } catch (e) {
+    throw E("bad-input", "the signer KeyObject could not produce a " + scheme.imp.name + " signature", e);
+  }
+}
+
 function signOverTbs(scheme, key, signedBytes, E) {
+  if (intrinsic.types.isKeyObject(key)) {
+    var koSig = _signWithKeyObject(key, scheme, signedBytes, E);
+    return _resolve(Promise, scheme.ecdsaDer ? validator.sig.rawToEcdsaDer(koSig, scheme.coordLen) : koSig);
+  }
+  var signer = _snapshotSigner(key);
+  if (signer) {
+    return _signExternally(signer, scheme, signedBytes, E).then(function (sig) {
+      return scheme.ecdsaDer ? validator.sig.rawToEcdsaDer(sig, scheme.coordLen) : sig;
+    });
+  }
   if (scheme.composite) {
     return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return _bufferFrom(sig); });
   }

package/lib/x509-sign.js

@@ -366,8 +366,14 @@ function _hasCriticalSan(extSpec) {
  * `extensions` object. `issuer` is the signing side: `{ key }` alone issues a self-signed certificate
  * (issuer = subject, signed with the subject's own key); `{ name, publicKey, key }` or `{ cert, key }`
  * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` (a `pki.key.generate`
- * private key passed directly, without exporting) or a PKCS#8 private key as DER (`Buffer`) or PEM
- * (`string`); a public or secret CryptoKey, or a `node:crypto` KeyObject, is refused. A `subjectAltName`
+ * private key passed directly, without exporting), a `node:crypto` `KeyObject`, a PKCS#8 private
+ * key as DER (`Buffer`) or PEM (`string`), or a signer `{ algorithm, publicKey, sign }` for a key
+ * this process cannot export, such as one in a hardware security module, a cloud key management
+ * service, a PKCS#11 token or a PIV slot. A `KeyObject` signs through `node:crypto`, so a key that
+ * refuses to export its private half still signs. `sign(bytes)` returns the bytes WebCrypto would
+ * return for that algorithm, which for ECDSA is the fixed-width `r || s` of RFC 9053 sec. 2.1, and
+ * holds its client in its own closure, since this verb snapshots its options. A public or secret
+ * key is refused whichever form carries it. A `subjectAltName`
  * (or any `GeneralName`) entry may be a form object (`{ dNSName: "..." }`) or a bare string classified
  * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
  * The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ca3c695a-64b2-4346-9529-6a6c719eb6bb",
+  "serialNumber": "urn:uuid:81aab9c8-7ee6-4344-8f73-8b672cade34f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-20T06:26:19.862Z",
+    "timestamp": "2026-09-20T07:41:52.928Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.4",
+      "bom-ref": "@blamejs/pki@0.8.6",
       "type": "application",
       "name": "pki",
-      "version": "0.8.4",
+      "version": "0.8.6",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.4",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.6",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.4",
+      "ref": "@blamejs/pki@0.8.6",
       "dependsOn": []
     }
   ]