[Max (maxtropets)]

This pulls out CSR core logic from EC keys PKI implementation and adds corresponding overloads to ML-DSA keys PKI.

What I kept

• still a part of public CCF interface
• Keys still own sign_csr() methods
  • I think there's no good reason for that, but I don't want to bloat this up too much, I need the PKI for the further PQ expansion.

What to consider as a follow-up

• remove CSRs from public interface

[Copilot]

🔵 Needs a closer look

The security-sensitive issuance and verification changes need human review and successful validation on both ML-DSA-capable and older OpenSSL builds.

No open issues 🎉

What changed in this PR

Adds ML-DSA certificate support to CCF's public cryptography API by sharing certificate signing request (CSR) logic with the existing EC implementation.

Changes:

• Extracts shared CSR creation and certificate issuance logic, retaining key-owned public methods.
• Adds ML-DSA certificate issuance and verification, with explicit runtime errors on older OpenSSL builds.
• Adds certificate tests and documents the public API changes.

Custom instructions used: Repository, changelog, and security/safety guidance supplied in the review context.

File	Description
src/​crypto/​verifier.cpp	Dispatches ML-DSA verification and public-key export.
src/​crypto/​test/​mldsa.cpp	Tests certificate issuance, verification, and invalid inputs.
src/​crypto/​openssl/​verifier.cpp	Recognizes ML-DSA certificate public keys.
src/​crypto/​openssl/​mldsa.h	Shares parameter-set detection and unsupported-build errors.
src/​crypto/​openssl/​mldsa_public_key.h	Declares native OpenSSL key construction.
src/​crypto/​openssl/​mldsa_public_key.cpp	Implements native key adoption and older-OpenSSL fallbacks.
src/​crypto/​openssl/​mldsa_key_pair.h	Declares ML-DSA CSR implementation methods.
src/​crypto/​openssl/​mldsa_key_pair.cpp	Implements ML-DSA issuance and compatibility fallbacks.
src/​crypto/​openssl/​ec_key_pair.cpp	Delegates EC issuance to shared CSR helpers.
src/​crypto/​openssl/​csr.h	Declares shared OpenSSL CSR helpers.
src/​crypto/​openssl/​csr.cpp	Implements shared CSR creation and certificate issuance.
include/​ccf/​crypto/​verifier.h	Adds ML-DSA support and documents digest restrictions.
include/​ccf/​crypto/​mldsa_public_key.h	Exposes public-key declarations on all builds.
include/​ccf/​crypto/​mldsa_parameter_set.h	Exposes parameter-set definitions on all builds.
include/​ccf/​crypto/​mldsa_key_pair.h	Adds public CSR and certificate issuance APIs.
include/​ccf/​crypto/​ec_key_pair.h	Aliases the shared CSR signer type.
include/​ccf/​crypto/​csr.h	Defines the shared CSR signer enumeration.
cmake/​crypto.cmake	Includes the shared CSR implementation in the build.
CHANGELOG.md	Documents ML-DSA certificate support and compatibility behavior.

_{Review effort: Balanced}