Function issue_client_cert 

pub fn issue_client_cert(
    ca_cert_pem: &str,
    ca_key_pem: &str,
    subject_common_name: &str,
) -> Result<Pem>

Issue a client certificate signed by the CA whose PEM cert + key are given. The returned key is generated fresh (server-side keygen path, e.g. the operator issue-client-cert CLI); the subject CN is the device identity.

The client keypair is ECDSA P-256 so the same profile can later be backed by a hardware keystore (iOS Secure Enclave / Android Keystore both support P-256; Ed25519 support is uneven). For the certless-client enrollment path the key never leaves the device: see sign_csr.