| CustodianHeldKeys | Selects which of the custodian's keys the host produces with, for a host that chose to keep the private halves where they never leave the custodian (UseKeysInCustodian). The keys belong to the operator: they are already provisioned in the custodian, so this only names them. Each algorithm is advertised on the published key and forwarded to the custodian on every operation, so it must be one the custodian provisions for that key. |
| ExternalKeysServiceCollectionExtensions | Wires an IKeyCustodian (an HSM, a cloud KMS, or a vault transit engine) in two steps: WHICH custodian holds the keys, and HOW the library uses it. The backend packages supply the first; the placement calls here supply the second, so a custodian and a placement compose freely instead of multiplying into one method per pair. |
| InMemoryKeyRing | A key ring whose keys are minted in this process and never leave it. |
| KeyCustodianBuilder | The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say HOW the library uses it. These are two independent choices, and the second one is the security posture - where the private half of a key lives - so it is named at the call site and never defaulted. The choices are UseKeysInCustodian, where the private half never enters this process and every signature and every CEK unwrap is a round-trip to the custodian, and UseKeysInProcess, where the library mints its own keys and the custodian only seals them. |
| KeyPlacementChoice | Records where the host chose to keep its private keys for its registered custodian, so the choice can be checked at startup rather than at the first key operation. |
| KeyRingOptions | Configuration of the key ring. |
| LocalKeys | What an in-process key ring mints, and how often. |
| MintedKeys | The policy for the placement where the server mints its own keys and the custodian only protects them (UseKeysInProcess): it generates them, encrypts them to the custodian's key-encryption key, keeps the ciphertext in a shared ring, and rotates on schedule. No key names here - the server names what it creates. |
| ProduceFirstOrdering | Orders a set of key versions so the one to produce with leads: whoever signs or encrypts takes the first key for an algorithm, while every version stays published so consumers can still verify or decrypt. |
| StoredKey | One entry of the key ring: a private key the server minted, encrypted to the custodian's key-encryption key, plus the two facts needed to place it without opening it. |