Updates

[flihp]

No description provided.

[flihp]

This should now have all of the updates that we can do w/o sending patches upstream. Specifically the vsss-rs crate is still pinned to rand_core 0.6 and the changes required there are non-trivial. We should probably squash all of the individual udpates to direct dependencies into a single commit

[flihp]

This has now been tested by running through the previous staging ceremony. This requires restoring a YubiHSM from the existing backups in evidence-room after removing the backups created in the previous ceremony:

cargo run --bin oks -- \
	--output output/ \
	--state state/ \
	hsm restore \
	--backups evidence-room/staging/backup/ \
	--share-method stdio \
	--verifier evidence-room/staging/backup/verifier.json

then generating the keys (cosmo & mfg platform id)

cargo run --bin oks -- \
	--state state/ \
	--output output/ \
	hsm generate \
	--auth-method stdio \
	--key-spec evidence-room/staging/2025-09_provisioning/input/

then initializing a CA for each key

cargo run --bin oks -- \
	--output output/ \
	--state state/ \
	ca --auth-method stdio initialize \
	--key-spec evidence-room/staging/2025-09_provisioning/input/ \
	--pkcs11-path /usr/lib/x86_64-linux-gnu/pkcs11/yubihsm_pkcs11.so

NOTE: the path to the yubihsm pkcs11 module is platform specific

then performing all of the signing operations required

cargo run --bin oks -- \
	--output output/ \
	--state state/ \
	ca --auth-method stdio sign \
	--spec evidence-room/staging/2025-09_provisioning/input/