feat(xmldsig): parse RSAKeyValue parameters

[polaz]

Problem

<ds:RSAKeyValue> is currently recognized only as a marker. Its modulus and exponent are discarded, and DefaultKeyResolver cannot verify signatures that provide an embedded RSA key without a certificate.

Implementation

• Parse ordered <ds:Modulus> and <ds:Exponent> CryptoBinary values with bounded XML Base64 decoding.
• Expose unsigned big-endian modulus and exponent through KeyValueInfo.
• Convert valid parameters into RSA SubjectPublicKeyInfo DER using the existing pure-Rust rsa crate.
• Resolve embedded RSA keys only for RSA signature methods and fail closed for malformed, weak, or incompatible keys.
• Verify the Merlin enveloping RSA donor vector end-to-end without a preset key.
• Update ROADMAP/DEVLOG after full verification.

Acceptance criteria

• Valid RSAKeyValue parameters are preserved exactly after Base64 decoding.
• Missing, reordered, duplicated, wrong-namespace, nested, empty, malformed, and oversized values are rejected with typed processing errors.
• The donor RSAKeyValue signature verifies through DefaultKeyResolver.
• ECDSA methods reject RSAKeyValue with an algorithm mismatch.
• cargo check, clippy, nextest, doctests, and build pass.

Estimate

2d 4h including implementation, regression and integration tests, review overhead, and documentation updates.

[coderabbitai]

🔗 Related PRs

#27 - feat(xmldsig): add ecdsa signature verification [merged]
#41 - test(xmldsig): add donor full verification suite accounting [merged]
#47 - feat(xmldsig): add KeyInfo dispatch parsing [merged]
#53 - feat(xmldsig): parse X509Certificate with x509-parser [merged]
#66 - feat(xmldsig): add key resolver configuration [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!