add support for hw keys certs and attestations

[ubiratansoares]

Towards #2501. Context here.

This PR introduces a new hardware-keys folder and assumes a convention that each subfolder corresponds to attestation files and (f9) certificates derived from a single Yubikey.

There is a minimal TOML schema addition + validation to link a team member with these folders and files. We don't expose any information from these files through team API for now.

Documentation on how to generate these files to rollow on Forge.

In general we can expect

• 1 intermediate certificate file + 2 attestations file per key
• a few members involved with TUF, signing, etc with 2+ hardware keys to brign info in

That means a few dozens of files a few Kbs each stored at this repo, which sounds doable.

I added two for myself related to PIV 9a (auth) as an example of these files.

[github-actions]

Dry-run check results

[WARN  rust_team::sync] sync-team is running in dry mode, no changes will be applied.
[INFO  rust_team::sync] synchronizing crates-io
[INFO  rust_team::sync] synchronizing github

[marcoieni]

Thanks! Some initial comments 👍

AI disclosure

I used GPT5.6-Sol with the codex harness to find 6/7 of these findings

[marcoieni]

we could also add the following validation: "Enforce that a key is only owned by exactly one person" to avoid duplicates and orphans

[ubiratansoares]

Added this new check here

[marcoieni]

I tried adding hardware-keys = ["36011225"] (your key) to my account and cargo run -- check pass.

[ubiratansoares]

Hopefully here this additional check is fixed. I ran a small test using our test fixtures and it should work as expected!

[marcoieni]

this function runs in a loop (wrapper takes person as an argument), so you are collecting all declared keys for every person. You can extract line 591-608 outside of the wrapper function.

[ubiratansoares]

Fixed here