Enum ClientKey 

pub enum ClientKey {
    Software(Zeroizing<String>),
    HardwareAlias(String),
}

Where a freshly generated client private key lives after CSR creation.

Variants

Software(Zeroizing<String>)

An extractable PKCS#8 PEM key (desktop / software path). The caller writes it to client.key at 0600. Wrapped in [Zeroizing] so the in-memory copy is wiped on drop.

HardwareAlias(String)

An opaque handle to a non-exportable key held in a platform hardware keystore (Secure Enclave / Android Keystore). The key never leaves the device; only this alias is recorded. Produced by mobile signers.