Threshold-OPRF measured-boot LUKS unlock (frost-gate): measured-boot PCR policy + non-auto-approving holder, DLEQ verifiability for partial evaluations, 3-node VM integration test, zeroize OPRF KeyShare on drop, move derived-secret delivery off the broadcast bus, cargo-audit/deny in CI, AK-pinning docs, and verifying-share cross-check.
This groups several tracked sub-tasks; break out individual PRs as you tackle them.
Threshold-OPRF measured-boot LUKS unlock (frost-gate): measured-boot PCR policy + non-auto-approving holder, DLEQ verifiability for partial evaluations, 3-node VM integration test, zeroize OPRF KeyShare on drop, move derived-secret delivery off the broadcast bus, cargo-audit/deny in CI, AK-pinning docs, and verifying-share cross-check.
This groups several tracked sub-tasks; break out individual PRs as you tackle them.