Introduce separate signing keys table

[Max (maxtropets)]

Continuing towards #7848.

Introducing SigningIdentity as a branch-off from ServiceIdentity.

• signing_identities = map { IdentityType=CLASSICAL|PQ -> Identity }; only CLASSICAL is populated.
• COSE ledger signature verification looks up the new table. An empty table uses the public key from service_info.cert as a CLASSICAL-only legacy fallback. Invalid signing material or failed verification does not trigger that fallback.
• Creation and recovery populate both representations atomically, using the same existing keypair. Certificate renewal leaves the signing key unchanged.

Current service identity still serves as "service identity" in service_info.cert.

• ServiceIdentity is the acknowledged service TLS certificate, keeping renewal via proposal and the existing certificate-based recovery flow.
• transition_service_to_open keeps its previous/next certificate checks. The existing classical endorsement chain continues endorsing previous service signing keys without changing its schema or behaviour.

Not in this PR

• Independent signing keypairs, PQ signing, per-type endorsement chains, or changes to recovery and receipt interfaces.
• Breaking user-facing changes are deferred. These changes target compatible support in the current release, preparing for that later separation.

[Copilot]

🟢 Approval recommended

The reviewed changes have no unresolved approval-blocking issues.

Pull request overview

Separates service TLS and ledger-signing identities into dedicated tables while preserving legacy ServiceInfo compatibility.

Changes:

• Adds and populates TLS and signing identity tables.
• Preserves signing identities during recovery.
• Updates certificate consumers and signature verification.
• Adds coverage for split identities and recovery continuity.

File summaries

File	Description
src/service/tables/tls_identities.h	Defines TLS identity storage and legacy fallback.
src/service/tables/signing_identities.h	Defines signing identity storage and legacy fallback.
src/service/network_tables.h	Registers the new identity tables.
src/service/internal_tables_access.h	Populates identities and enforces continuity.
src/node/test/history.cpp	Tests verification with separated identities.
src/node/rpc/test/internal_tables_access_test.cpp	Tests signing identity continuity during recovery.
src/node/rpc/node_frontend.h	Returns the TLS identity as the service certificate.
src/node/recovery_decision_protocol.cpp	Uses the TLS identity during recovery transitions.
src/node/node_state.h	Validates service transitions against the TLS identity.
src/node/history.h	Verifies signatures using the signing identity.
src/node/gov/handlers/service_state.h	Exposes the TLS identity through governance APIs.

Review details

• Files reviewed: 11/11 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The audit documentation must accurately describe the signing identity value encoding.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Balanced