Certifies a realm's post-quantum keys under its JOSE Issuing CA.
Idempotent per key: a slot already over this key from the current Issuing CA is left alone. Answers and does not throw.
the realm
the keys, { alg, publicJwk } read from each
{ alg, publicJwk }
kids whose displaced certificates are kept rather than superseded
a promise of { ok, certified, unchanged, failed }
{ ok, certified, unchanged, failed }
Certifies a realm's post-quantum keys under its JOSE Issuing CA.
Idempotent per key: a slot already over this key from the current Issuing CA is left alone. Answers and does not throw.