[Bugs5382]

What and why

With state_key.mode: tpm, an RSA pki.root_key_alg made the ceremony fail, because every layer of the TPM path only handled ECC. This PR lets a TPM create and hold an RSA-3072 or RSA-4096 CA key. The key is loaded through the same RootKeyBackend and key loader as the ECDSA key, and it has the same fixedTPM, fixedParent and sensitiveDataOrigin attributes. The crypto path still uses only stdlib and go-tpm, and there are no new Go dependencies.

• Template, parser, signer. RSA keys get a template with a null scheme, so the key has no padding or hash baked in. Sign takes the hash (SHA-256, SHA-384 or SHA-512) and the padding (PKCS#1 v1.5, or PSS for *rsa.PSSOptions) from crypto.SignerOpts, and returns the raw signature, not ASN.1-wrapped. Every RSA signature is checked against the public key before it's returned. That catches a faulty signature, and it also catches a PSS salt length the TPM picked that differs from the one the caller asked for. ECDSA signing behaves as before.
• The floor. RSA-2048 is still refused for a TPM-held CA key, in CreateKey and in LoadKey, to match the 3072-bit subject-key rule.
• When the TPM lacks the size. The TPM 2.0 spec only requires RSA-2048, and many parts stop there. For RSA, CreateKey first calls TPM2_TestParms. If the TPM doesn't implement the size, it returns tpm.ErrKeyAlgorithmUnsupported and creates nothing. The root ceremony and CA-key rotation turn that into FailedPrecondition, and the message names the algorithm. The ceremony can then be run again with another algorithm. An intermediate or issuing node creates its key at first boot, so on that node boot stops with the same error (fail closed, as before). Nothing ever falls back to a smaller size or to a software key.
• Probing. Probe now also reports which RSA sizes the TPM accepts (Capabilities.RSAKeyBits, SupportsRSAKeyBits), and boot logs init: TPM capabilities: ECC curves [...], RSA key sizes [...]. The P-384 boot check hasn't changed.
• Export. Export is still refused for any TPM-held key. The mode check is now a named helper, caKeyExportable, so it can be tested.
• Test hooks. init.NewTPMRootBackend and tpm.OpenTransport exist so the end-to-end test can drive the production backend against swtpm.

Testing against a TPM that has RSA-3072

The in-process simulator the TPM tests use (go-tpm-tools' build of the Microsoft reference TPM) implements RSA-2048 only. Its build profile turns RSA-3072 off, and enabling it with a define crashes the simulator at reset. So the tests are split:

• In the simulator (always runs):
  • RSA-3072 and RSA-4096 are refused with ErrKeyAlgorithmUnsupported, and no TPM2_Create is sent. This is a real refusal from the simulator, not a fake.
  • The ceremony returns FailedPrecondition naming RSA-3072, commits no identity, and then succeeds on a retry with ECDSA-P384.
  • Rotation returns FailedPrecondition and stages nothing.
  • The RSA signing mechanics are tested on a 2048-bit key made through the same template and load path: PKCS#1 v1.5 with SHA-256, SHA-384 and SHA-512, PSS honoured from opts, and bad input rejected.
  • The key attributes are identical to the ECDSA key's.
• Against swtpm (internal/e2e/tpm_rsa_e2e_test.go): the real ceremony in tpm mode with RSA-3072. Then a reboot (swtpm restarts on its persisted state), and a reload through the production backend. The reloaded key then signs a leaf, a subordinate CA, a CSR, a CRL and a delegated OCSP responder. Everything verifies and is SHA-2 RSA signed. The test also checks that the stored key is a TPM RSA object with fixedTPM, fixedParent and sensitiveDataOrigin. It skips when swtpm isn't installed, but fails under CI, and ci-go now installs swtpm from apt, as ci-image already does for its toolchain.

swtpm 0.10.2 (locally) and swtpm 0.7.3 with libtpms 0.9.3 (the Ubuntu 24.04 packages CI installs) implement RSA-3072, and 0.10.2 does not implement RSA-4096. So RSA-4096 has only been checked on its refusal path, not created in a TPM.

Tests changed

TestPublicTemplateRejectsRSA became TestPublicTemplateRSAFloor. The behaviour it pinned (every RSA size refused on the TPM path) is what this PR changes. It now pins RSA-2048 refused (the error names the 3072 floor) and RSA-3072 and RSA-4096 accepted. No other existing test was changed.

Docs

• docs/vmca-subordination.md: the "not supported, see feat(tpm): hold an RSA CA key in the TPM #197" line is replaced with a caution callout. It covers the RSA-2048-only guarantee, how the node fails when the TPM lacks the size, the boot log line, and what to do instead.
• README.md: the TPM-bound identity bullet, the swtpm test prerequisite, and the ci-go line.
• Companion docs, one commit on each docs-site branch (all into docs/stub-pages). Merge them together with this PR:
  • docs(reference): write the reference pages from the alpha docs#35 (docs/reference/machine-config-pki.md, machine-config.md): 89e398b
  • docs(use-cases): write the use-cases pages from the alpha docs#31 (docs/use-cases/air-gapped-root.md): 720c38e
  • docs(deep-dives): write the deep-dives pages from the alpha docs#33 (docs/deep-dives/keys-never-leave-tpm.md): b7252c8

Overlap with other open PRs

• docs: OS-specific commands and risk callouts #277 changes the same paragraph in docs/vmca-subordination.md, turning it into a callout. Whichever merges second resolves it: keep this PR's text inside docs: OS-specific commands and risk callouts #277's callout form.
• docs: OS-specific commands and risk callouts #277 and feat(init): keep the node clock in sync with a client-only SNTP #271 also touch README.md, and feat(init): keep the node clock in sync with a client-only SNTP #271 touches internal/init/run.go. The hunks don't overlap, so no merge order is needed.
• fix(attest): bind Attest signatures to a versioned attestation context #279 has no overlap.

Closes #197

Verification

• Lint clean
• Tests pass
• Build succeeds
• Documentation updated (if behavior or API changed)

How this was verified

• task ci (fmt, golangci-lint, vet, go test ./..., build) passes locally with swtpm 0.10.2 on PATH, so the swtpm end-to-end test ran and passed. Locally, TMPDIR=/tmp was needed because macOS's long default temp path breaks the existing internal/grpc unix-socket test. That's unrelated to this change, and the test passes with a short path.
• CI's first run caught something real: Ubuntu's libtpms answers the ceremony's RSA signature with TPM_RC_RETRY. On a node, the Linux TPM driver behind /dev/tpmrm0 resends a command that gets TPM_RC_RETRY or TPM_RC_TESTING. The test's raw swtpm socket has no driver, so the test transport now resends the same way (second commit). Production code is unchanged by that fix. CI is now green, and the end-to-end test ran there against swtpm.
• golic license check: 0 files changed. actionlint is clean on ci-go.yml. The pre-push hook passed.
• Red first: the new simulator tests and the ceremony and rotation FailedPrecondition tests failed before the implementation. The ceremony test failed with Internal, and the probe and signer tests didn't compile.

[Bugs5382]

Closing summary: an RSA CA key (3072 bits and up) is now created and held in the TPM through the single key loader, and the ceremony fails early when the TPM can't do the requested size. The swtpm transport resends on TPM_RC_RETRY. Rebased onto main after #285; CI green on 50b5fe6, including the swtpm RSA-3072 end-to-end test. Squash-merging with the owner's approval; closes #197.