IKeyCustodianBuilder Interface
The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say
HOW the library uses it. These are two independent choices, and the second one is the security posture - where
the private half of a key lives - so it is named at the call site and never defaulted. The choices are
UseKeysInCustodian, where the private half never enters this process and every signature and every CEK
unwrap is a round-trip to the custodian, and UseKeysInProcess, where the library mints its own keys and
the custodian only seals them.
public interface IKeyCustodianBuilderDerived
↳ KeyCustodianBuilder
Remarks
A host that drops this builder without naming a placement fails at startup, rather than falling back silently to whatever keys its configuration happens to carry - which would leave a configured custodian, a clean log, and local keys.
Properties
IKeyCustodianBuilder.Services Property
The collection the placement call records its choice into.
Microsoft.Extensions.DependencyInjection.IServiceCollection Services { get; }