mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-11-01 05:58:12 -06:00
Token identities that macOS exposes through CryptoTokenKit (a CAC or PIV card in a reader) were not listed: the Keychain search only covered the file-based keychains. keychain::identities now also searches the token access group, de-duplicates by certificate, and skips card certificates whose key usage allows neither digitalSignature nor nonRepudiation (the CAC encryption certificate, which would produce a signature that fails validation). Card identities are labelled "(smart card)" in the sign dialog. The key never leaves the card; macOS asks for the PIN. Claude-Session: https://claude.ai/code/session_0158vdscYZsFFCPLjokXoyzM Co-authored-by: sfv9 <286824270+sfv9@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>