From 5799ac6126f505606e41b1a18a5ea0c8a868222e Mon Sep 17 00:00:00 2001
From: Emma Stensland <emma.stensland@wolfssl.com>
Date: Thu, 25 Jun 2026 15:26:45 -0600
Subject: [PATCH] openssl compat errors and mldsa oid fix

---
 certs/mldsa/README.txt                |  28 +++++
 certs/mldsa/include.am                |   6 +
 certs/mldsa/mldsa65-leaf87ca-cert.der | Bin 0 -> 6973 bytes
 certs/mldsa/mldsa65-leaf87ca-cert.pem | 148 +++++++++++++++++++++++
 certs/mldsa/mldsa65-leaf87ca-key.pem  |  88 ++++++++++++++
 certs/mldsa/mldsa87-ca-cert.der       | Bin 0 -> 7608 bytes
 certs/mldsa/mldsa87-ca-cert.pem       | 161 ++++++++++++++++++++++++++
 certs/mldsa/mldsa87-ca-key.pem        | 106 +++++++++++++++++
 certs/renewcerts.sh                   |  39 +++++++
 src/ssl.c                             |   6 +-
 src/x509.c                            |  19 ++-
 tests/api/test_mldsa.c                |   5 -
 tests/api/test_ossl_x509_crypto.c     | 104 +++++++++++++++++
 tests/api/test_ossl_x509_crypto.h     |   6 +
 wolfcrypt/src/evp_pk.c                |  18 ++-
 wolfcrypt/src/logging.c               |   8 +-
 wolfcrypt/src/wc_mldsa.c              |  71 ++++++------
 wolfssl/ssl.h                         |   3 +
 wolfssl/wolfcrypt/wc_mldsa.h          |   2 -
 19 files changed, 769 insertions(+), 49 deletions(-)
 create mode 100644 certs/mldsa/mldsa65-leaf87ca-cert.der
 create mode 100644 certs/mldsa/mldsa65-leaf87ca-cert.pem
 create mode 100644 certs/mldsa/mldsa65-leaf87ca-key.pem
 create mode 100644 certs/mldsa/mldsa87-ca-cert.der
 create mode 100644 certs/mldsa/mldsa87-ca-cert.pem
 create mode 100644 certs/mldsa/mldsa87-ca-key.pem

diff --git a/certs/mldsa/README.txt b/certs/mldsa/README.txt
index a5a7e11a6d..34570edcb7 100644
--- a/certs/mldsa/README.txt
+++ b/certs/mldsa/README.txt
@@ -36,3 +36,31 @@ using OpenSSL 3.5+:
 Regenerating the private-key variants requires producing each of the
 PKCS#8 shape options explicitly; OpenSSL's default output is the
 seed-and-expanded form.
+
+Cross-level chain (tests that verification uses the verifying key's own
+ML-DSA level, not the leaf's):
+  mldsa87-ca-cert.pem / .der         self-signed ML-DSA-87 CA certificate
+  mldsa87-ca-key.pem                 CA private key (PEM, seed-and-expanded)
+  mldsa65-leaf87ca-cert.pem / .der   ML-DSA-65 leaf certificate signed by the
+                                      ML-DSA-87 CA above
+  mldsa65-leaf87ca-key.pem           leaf private key (PEM, seed-and-expanded)
+
+Generated with OpenSSL 3.5+:
+
+  openssl genpkey -algorithm ML-DSA-87 -out mldsa87-ca-key.pem
+  openssl req -x509 -new -key mldsa87-ca-key.pem -days 3650 \
+      -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-87 CA" \
+      -out mldsa87-ca-cert.pem
+
+  openssl genpkey -algorithm ML-DSA-65 -out mldsa65-leaf87ca-key.pem
+  openssl req -new -key mldsa65-leaf87ca-key.pem \
+      -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-65 leaf signed by ML-DSA-87" \
+      -out leaf.csr
+  openssl x509 -req -in leaf.csr -CA mldsa87-ca-cert.pem \
+      -CAkey mldsa87-ca-key.pem -CAcreateserial -days 3650 \
+      -out mldsa65-leaf87ca-cert.pem
+
+  openssl x509 -in mldsa87-ca-cert.pem -outform DER \
+      -out mldsa87-ca-cert.der
+  openssl x509 -in mldsa65-leaf87ca-cert.pem -outform DER \
+      -out mldsa65-leaf87ca-cert.der
diff --git a/certs/mldsa/include.am b/certs/mldsa/include.am
index cf6489f9ef..45c7120b9c 100644
--- a/certs/mldsa/include.am
+++ b/certs/mldsa/include.am
@@ -38,6 +38,12 @@ EXTRA_DIST += \
 		 certs/mldsa/mldsa87-key.der \
 		 certs/mldsa/mldsa87-cert.pem \
 		 certs/mldsa/mldsa87-cert.der \
+		 certs/mldsa/mldsa87-ca-key.pem \
+		 certs/mldsa/mldsa87-ca-cert.pem \
+		 certs/mldsa/mldsa87-ca-cert.der \
+		 certs/mldsa/mldsa65-leaf87ca-key.pem \
+		 certs/mldsa/mldsa65-leaf87ca-cert.pem \
+		 certs/mldsa/mldsa65-leaf87ca-cert.der \
 		 certs/mldsa/bench_mldsa_44_key.der \
 		 certs/mldsa/bench_mldsa_44_pubkey.der \
 		 certs/mldsa/bench_mldsa_65_key.der \
diff --git a/certs/mldsa/mldsa65-leaf87ca-cert.der b/certs/mldsa/mldsa65-leaf87ca-cert.der
new file mode 100644
index 0000000000000000000000000000000000000000..fb87ddfd37e176247ac743917585ee5e9fcf1478
GIT binary patch
literal 6973
zcmXqLlD0Hx;uKiG%*4pVBx11Wg2Kwg=~vEVo@5f0$zj|nVWMfk&BmF~=E0cC%)%^e
z5M{`1z{$oO%EBhh6dG(OV893BaPYAE=I50p<|V>J*m>BU@~cvF6Z2pqTs-XM`8jF9
z!9Iqf2Erg+%sf24KDsW!j=C1+3eJuOa^k#3W(MX4mWGz57N+J=;=INnt{IeTP(Tg4
zwGA{Ob}K>cHZxVoNli>sD9%jJOHENos#JhVSeP3$v2Q~5z7TU0`$7gbdAA!klm0$x
z&5Ak3bzSq<9HC#&f174(?|0<#d$8$_e!tX*REO|c*S}9?m)UXpD(n3e1%8h^kB?rg
zpT_%FeDXKfgA)xIyVbL!Y}W<qCa&MQnD>jb<Jl``?3yesO}onaZJr-qZ}M9y`Ru<c
z4+ZuIdt*4i<sS)I?5utAplfEK{>hYF#-M`BJ5F}Z4z`_@XYyX-yX0!gZLG`GyBHZ&
zyj^X#Jo>zMnx=x%mIk>CRsAy6n{{7VZH(gGxKd(LN8YNu3#lfF{3T4GnO7>}-Pv`1
zzkkL4<kZZUb`1|yg2F482$mh1Z?fY?NlJ8|+C<x}?E?CyGoF`BHT<(~R`BKk&b03C
zuLtH|$y{FI<#)OAp`hmedt2I1>+JV*<X>v{EKhaS`Kv3Jd1!v}G&5Vwo0*l6w{^j`
zgVFaZmIpr<sG9hTW7EeRk10_OD&;{tjH-9fz7aLyK|!AD*6C)^_NR>QX;v*bBr!*M
z&V|ZH+b+F2%XT*)G3;aBzCQ;-UrS6&@mHOZ@@3)kiuuQb?@vqHxYBV|W76Ev1Hnt)
z8~@w9=O*K=MW?D<SveimAIj`W`hTl$WyCpl!%d9R`z7~Gk-KoN#=$t9X~+A9t#!vf
zd1{KsYi+x8zNr0Lqujr5j}2CSl9}uIe&>evC^43A3&nTZ6)st!(=NPe-Ez}EQi@xC
z2FZ2J{9z&d^l$Ow!-cicdYYC@jLRfknC)gWH>G~rFJtuff4{TexAKdzq8lfco8(sS
zco<i~yXDc2zpq>G_XZrjcdnYfTUvGBp6J4^gI|~yL@7q7-TQp-)4#A_7SrV+D(<ES
zud|+Ziur#+d15*Dnn$vyJ>ynbTmR8^pUL~Ct+Ogjtt9Sb6WhHu+b45($4*r_b-S<V
zdYG50z0<-I=j!7AZ~L_HYt^Z%>t70W95g8A$og_KXqS|i#D=<p-K>H#j?)vFjn_Mz
z@Z|q3<`o~;^M9Ky$3CW5^>sE5k_&Waawx62IpO<)XEE**xt(`DZ*WaL>)ks4sET^P
z!>MVW0_6ggYCZdJ^TvO&T6)7_=|TZ-t}V|l<aExp+VbU7+n(SgwM(gQg0!9O-z?rY
zZ{@ik8>MgLzE1vXq;#x8LEG&E!ymgjNn8GWJ(hRNH?#VJ0n>k<cPawudOO-1%=Pte
ztXTQ3{b9S#>h}?EC)+o-PZSQGqMs6G`g)7@RcXWTF$*WD*DJ;8Carn$=C1t$zi$TG
z+@}RMeK7Ao_++PJe#ACiu^Ts8dCxPa#RxLgZ%NxE>BU}ofkmj{?QIRyRoepsT4iEy
zgnRya;Gn28bxF$Ro%`0bh&BIJS+uLM&{Ox{-}{2b3qCgO4K50hS|4o0H2FKPY=+9@
zg2H2a%vP??UB;@v_yfl(KDDZSOd_c(Swqq`ztG%UoANQe`-t+Nl|QC+oLJ569=fix
z{tX{rZFT9Sr0=@~E0*qYs?4~__T_JW*FSBy&xL~90-L$N&x_LRm@O*#?(5krN~V!X
z>%V@~=liDpuCdztU3czbU7N23PH*$(tnquWSHQsN|G^fkJ(uL&?zQeJFn>QqX=m-l
z1G_dC{bBu*`N1V(dS-Qs^lT>4puMa2AKhOOBd}uC0^=1ta#uq<J}Un`>Yy2KlPnT-
zm+$$u)>S<2ZsI0eg;(cX6R8tuGq5k3Uwp~KX71$~3A>aPcHb@Am2=VI-pj*>+*^V@
zXL8CZB`BO;u;kP4D*}$^<o%aBmOin$b~DN4+}=3{Kg&;#oB7q9_3wi{Ka#g)D@#91
zd$jAv-v@eHHog8U|L<Did6Iqit@+z-Zb?<U;c`PrYJ24^j&1sSoIHGK1yh>eU+P@1
zcB5+5#0QNISA^?MtT(!NozW<0X2hgbYl7V}8`zb-Wp{a<&W?9K%luf7an6&EtkJp)
zUmbUs=04Q+<n#4H-HG=WyO*TTNlY+4!E(8LlA3wZy@JLC@8&xlZr|GGvvu2Do6<=>
zjyz3smP+(Kycz%ON5qx>A4k7W+gW_W^s-QfNX3GS*QeYs6w<SO;npnmt4#Lk5pnI(
zX|^WGF`F1W=hdz{;2w2T+pelu|Lm!UIlCpirt7q+GVkB6lE!|=V}E_q#jeDNstC*Z
z{!7E7J{K=@3$aRhXOnwdd~QaCdUeO=C|jeSOzFS8%}m}g?btj|BDdT;ylJh`wndBA
zeE%VItLFLC%Z`^nF6J@`;$hmks$r|--jBWiB(+@+9eogxa?Cn>&1HvYvqP;?xQ}&z
zmN{5k_vypwgWN8)k}g@3o;f_-?q|*Ab#IHl-G2R8R)-9}&<#pC?@!lA&a2$w+{${?
zE`8_!4|bK`Rb86e{pM=j+2Z$NufVIChbeL?j9OVTcX#bCP!u_uWAV7Fc<Sfg8O^u9
z^X})cN}0X<e75HD+`9)N*?R;wU-fXV_!Sk9e(2n`%A%fi@jfD)Cj|C;E9)N)yca)r
zWBQ+5uNa9<+Sdi_UVdt*+E({@!G*tUzGpq$j=pobwU~Xe(kDgHC&!h9KHfS~o_Nwn
zC7^As?DL55T}$VkUoBSr<!#~LuX3qw%@d~ljJLe)D(cW;vUd89-^XX`WjJXww$C}(
z`BA?xGW|=%xrw`<a5LF`P6-oen7_)rNUM5}8bjrqH`xth|K}WuDR<d#UbML@bXsTd
zg=NZ7;d6NO4SvU5DY~@w+U-XyCl@;zI2g#XF^9_Xv52vVNTi)Q_aVIE_wI9v_m=TS
z{WhEFnr9#nl2&GsFc51HDRs@8-Wg@Dv_$FtZf=JYyy@!S7b4gC!pu!VA`G&XHr7AC
z&rpwe?r7vyqHEZrao)P|-sD5p9Tv;vi|@+Y@-x<EWgJ{zyePkI<Fz8!?Ye*a&UiAo
zJ-Dkip_WT}b&R62{S{5^*GrQcqOT=iG;J3CGvlUZ`-DWRO*XA}Q)k<AO;K2}Rp7Ob
zxwGiK89xoLr~J5{{Be=#)CSWv`~rQt^2=W6Or2c5zruLxnO6;$pPO*zOH~W-?I_*w
zPT_~|hTHw3pElbmukPO-ad7^Tr0J7_ayeFdO%wO!Zf`lZtWbXbnoD`7TB`P~PP}tS
z_hV!h%L%vNYb8a5HZJ}rn)-UbEKk7Pjmrg_6J&0F^)xK8NPlDUGl|iAS+`?#TfTzR
z^^JvJR$MYMx@WxehJbg{9D9{gFUeV+8xMx-HaBG4y0zWcMEd50Q~H@!S1<RlFg*Xa
z`fO&|Rkqv&r+HDGcFP-Eeyi37m-BpDmysAZbwUVZf2B_s|24)n&!#<*+T|hL_UrqT
z%=4yZn>T!Uxc}Ww1=eQkq{Z#Jv*H&oI~B4!h_h=)jBpqK?6d0U6_^fq%=vs^Vd1+&
zU1@qBKg}^>uT4EC>t+&kJpWkD&kH-7JTnF2+2*|!S@`c`?3O8&Czj6=IqW(6$i#N>
z%<yN|1tgr9wR_5**L&xw%D-Io@IYX9ZS8&c#%T|gKmYmIXle7vz`}Idn#M)CkMr-z
zFXs8aTjkQJy)C^b(&}g2*e+VQ%Ip%8WMEJ4krrLP&t@Xu&HlbmpWFC%e|Z_#C*`D*
z=d$z97<NTfuK6_0^>{^*aO76jjdT3oYM*3lHDzvnUoiWb;hpB3Wq%iO|MI(4s=I&b
zygBxB+V@O<cvRFzmw8bIA6K7?#QKi%kLxdY|2(!_afj+t!AD!|+I^S5Dqk~&VNcTb
zCw*!Hic9jVetj}^_B<97bWY)y@z1K7<Co^0K5AI{;NIiK=L@5k+J1|UW3uWqnEa()
zQELOs?w|5uI~waZY?l*1KPfX!vRi(8fK!D)oi*#LKm3KE8g{$IG^GNI-J<W7u<-2P
z_12>C>LTCue|-3D)N@jW{0}+SgvnjZI<xim?rW9baz2_lrC)q}A?>!<(t`WEr<v#F
z-kik7o0RDu%=g|iF{e$Maf|du+11QPR({xWBe<90qQU7njo>ZaZZbZ+yAPOsT7C4z
zq~d2sy0{GM*X)W}ebh|S`n*~8`k2ae?Hu7NoIaJW_HfmTKVs%Pd3M3n;{hJqX5M91
zyzC+-YaAk+t*C#kg(=_(zr(Tga;En$c4QusDmpe(QRzfuN3__-PZReQ{611TW%{xQ
zMj~(g3i48SXV*HN?yuT%@#?ynb*mKF)6@39<YKQ6$z^^eX09J|T$MZQh_4Te)PxUh
zpKh@g&C3rFd?4}2hd1nF*ay|CB74`KGMM>bv;65<lPg#I{a;^j-hG`bgI~7J-k6|(
z59eLBo|<|3b=aX@5z>qv?zMi|eQ^y>ni=0YUH$yXe?|VDcO9DU`3&C|Ufb=r=1&z5
zgRR)TrVV{<t8aa7j1xN7dNbv`rO=U=7TU{C7aTU-oSU7$tY2Wt&reI4OLG<c*S}b?
zndj29wv5kx{p({ZBSTN^Wj|K4M_xub<wi@J<*PHL|Jrib%6V=5dsy5=_i0RGcKVT>
zw=TC@xor3S;Z>wRyW-2MiO;_+e|Y|~nAxn@(qk-)hZbFGnUita;)G)4iqwbapI>I1
zllA7YiNa!K|C2m|laDT%>15aR`Pahcmp?dE19e{nL^pg}&a<xh6zj#xukm`kP1}#z
zPu|pKm79^UyCzu2$LeI^k(pZ$asT=}>q<u6d$vf^3=6~N3x~WWruXfsSsU^E*M;|b
z6K<Xnn-Fj(%sFM^^fLmcMRRsP3i|Ws>)p8(9B<~G`hEVIZtb%ovFuF=54!Avr{4N|
ztMG@*!F~I0U7O0${xc|c$I3ffUhL8FT>SfIk$r{u(dVWt4Y3N3KW66h$7+W#U%TE?
zp}GE^C*L2Y)KgcOzh85FHYG#Q_?CZ#>9)HYb{*HUoOq(B;m0fvw`dl{k18ug4*D<D
z`0{IyO)8sp$+wJtvl+J+^s0Nz+U6KA>GJ=GgCFdt8;KXBWNB@$cpp%e&;E;jX=CPO
zo3{_N^@UHI$u$gm?s4$i)8y5+eV@25;C%MU>Dql`)_Xh5YD#D5N+w_HklU1gU#0YU
zz^CUA_WhUNQ}v?0@YMRLCwhdgS?NCcnJHtN8Sz<Z!E=q$%ZdVjj93^&wGAz2TU_B~
zesN9tWAy$v@7(V`*y#T3_3ke95UErFJ?+d_$6OE2yc*=Px!{wui01VkZdT732R`n3
zy!bxb%6}cD<%d_^`I2|~0E^bn)+6mF=Qa4pMs*wO&9C#nTfAn!#_o_mQ>)%3<ko+A
zaeB$4`|`hDpORFoU$U+{D^q!APP*z3&);TSt3&hqoPWRV+WPdwnq&Ls&S`hM@n6X*
zqjqOYuW9q|rKX!~7F~1q^{@MDA)l3UFzfGeaic53TFNDhMPp9Xx@|p>^ZxPlWu@CT
zYQMP?Fn?jCe#xetZ|%;`7qZ;n^ZsRf%#&DUz0Qk9lUMxcjLEzu@Qp=jQq-&0p?wUk
z3wtcmBLxgD_U$#C+5c?H)cZ+l-{&$`)jf3G+`e&IG>4u-X4LvsmRsjvaL7v#HSRbm
zr=Xu&_xk;^z|EhVDwPV(t(ELw{?uyaYts)47tEZ-Xso;I*5i2{lc)T8ws%^@+)XP5
zxLy<ru4PNAQ!a~7&0ANys>33_qx+ocs%Pffla*U+ohLC_9(o!+v2*>5#u@QUX(c;^
zIlH~;uY{he<3DsG&osknZcOQ^DHcDQZ{4|Zf0^(~&yPVh*Q>sK)%h6paZ`Kar}{^R
zl|HX_rz$qwYndWo8Zl9d+oAn!-&ux@jtVpVvfj2%S(TD@%S3ic>HB%+Tf}B9o3bio
z@zFT9D8;7le?pFKo5UF5s3fvlhv$GYr)$o<hs{TeA4`N9NiG$y5Hy?>%XRDhQQ>bM
z3X^a4Ufy^A=Iyl9g6yEgvyY#CkAK0t@z>%99+#@l1aLQ9|MuhUuG#ISb>&+^PgOV{
z{juOM>yh1`9=cEMOyN!RbPLUTS!46<(QhU5Tk|K};62^Uc<e@UcKe1OK8K>cmX=O2
z-~agf(~t%KR&cT0?okQ5oHkuz;)yMjxEH9HT;vjNsCp;TQmLlGbx)M_R`gem`-wU)
zMQ6CXYclVd9#fb)L-^dUr=98!AETXbK7YMf^uXgoc4gJo(tB2a3zB$w==YKOZHJ2@
zRti3ADTy}H@7w1gXMMLs?%7P1yj?$&er$_0>Zobl(P!ahd1}wkCvSGeGA=9AuZgIz
zXf;<(_<Gu+zoMx=wQ$E9ty!F_@0@40{C3f~|4xJ9X`OFM{A^pIg&Jl&GxE!EZoj(q
z(AU?yuCmm$X=Jo#-$@YU+4<*Sm9d%p1W&b!_pzazva95k4=voD6yt5ZTHSFAYeut3
z{%!Yj69V_%y`A}A@zBMBoG+8ka`9;RT|KeogNAR><gZ1KtQ2DE8uQFAzF2UEp=@eI
zRNvPeh48$;aosX<B5w|D<0{qF7HU5eYBs^RcmJa`Pa2~a7)?Gg=e|LVuv?R=;6nlZ
zsaKa4G1zU=ob$cu^lgp@wN1R|8U8r3{CKA=?CZ?)<GQfh+Eq{TD#FDA7cBF;F!x;X
z=Z(J?ZH+$```;=#$Aa}qf8g)p`3scR*p}WF&DOKYTQ7S?ys&0+V8u$QC-I&C<_7QH
z@2MqjHX-fQ#3i*;dN0}6T3`HsMTTwV{<ysYH+h|&N9#+?7vfr>=_+l!VVzOtmkDwO
zJH5_pzO%Nrxu9Rx#GZY}Ohd&+l>fD=yqL0?YQB`v0*zDK+AjM&o3(Ju;>nHf)z+!c
z?*>X=`4w)@#Oci^qWs5c(cj;RY7b^Tf1o$@$yu#EcjD^pcm7EX(bN}WE-vNKSXz4i
z%h#^>X-13dA8Wq<=KOYTUf_fLhV6{?$3II6de|;Gd9aLO7T0t3P4n-6*ZQz{ww1GP
z!r?9j<F%`9eCs^>H(p%i%2fyV9k(RacRGLjB{AjYhvdCGuAUZH(EeQPq`Gac!=JfU
zFPubMn6;)Grw16aNWANFiu$@j@<v6*fz5rf6IAw3n?9+UQMTgL9(L;zx%&qFeYHE!
ziTzvgrQPmTxIxY@w!$xuCoC-O45|1#L*~`S-$|v}sV?kR{&$uCPAXR8|7v=#QZb?7
zXk$b+=XnJ^PrHAN|Ldh{f<G~O%L%1^)#JX*{%f&D>tSuT?-iUu2~$6Yy6i4#IjppR
zoBN7P)Jh?twi+IWBsPgzi+}U-G-nj=77S<p-}NSR&HcTn7TwTcR&{0IJ;v+&#VD3@
zI+vPDbMWg*4WWOwwxw*->b5AciaHDW%Ve1ZGFyG|O+M)J#7xI-a>9pwn`T>_Y4YV3
zWz-kW_;{LU_eS$4J+sASKDV9S`(u&z;;OE|<iGR0{0@~~4YN3F^LyKhD+bdi>oKh^
zl=;0-;k}Qo{j?Pu&waU)VZeVWYyO!PSMMfSs+MT%`ugV~?{$8`xt$kYvpu!TU1GjC
za9wN6gvRxSxvGlXzG}O6udrAgRr^m~^OR?kneJq^i?_HA+2norpyP76S^CEN(DuW3
zUvOKk-!kin=2{nx^Cy<2|5GUyJGo@3=%UM2<;GJ2!YrS!Y(KM1l~Fk2*%QC^BuC!;
zLcjH%EqKHe!TI%COy6YJsQoJ$<7Z0yJgB*Hw<h;qjN_}7Ny5L>LT;YwUbMltXVHQ*
zf3`^Hb^pKIdgEH7cKQD%Md_y>*!A|cnja0@GS#o`_+}0Nr02iIf4_YeY*%!Bu4GF1
z&)%ZYM;jl^`P*esShG3d&qND<F-LCJ_?)92UVEcmx9?V*?WHhv&n}t&eRsCpsC42k
z2%Xe$qs#LQces|*lZ8e4CC`*p*15GZFG|^V!T7Q8s$*e+ol~7c)X&ZN^1s^d;%tek
z=Soh^)gf~{UWTPT-V=H0aP+;~jtRdPFuZ0>%QiQvx3S89k!++9$8We{J6F)7oU>b9
z-xvNp@7w2eJxudQj+?Ld{IUc$=F$w-cOAZhcAcwKZQ2<37K)Z#x*xoHH|qz%b+4Cw
znt#F2yUk*9#M^T`>UWpRa9sX-q2z)4{ImY72bGrGWPZ`3U*NH?d)w?CZS6a`^wS&u
zHvU*MG1X^FV@{>gFD}QrHo?s=4B~2k#2zY}*~_26Xs+F}wTWeBm}Htwl2NBQ&$*&~
zH!fXLl(KqQ*}bDaWv$!pB`Oc!FXi=gnYpRaIv}@Ch+ods!KqO~vwMe2O(oy2x68hK
zQ{A+6WiHpv&TBunMwIsmmM@%gOHxVm$&wY}3X>yldhUPk_h+5diN>dMUj<(0ZKyZA
zWB$Izf!ny!RXIcQgwO$-sU9z$$bJiLaaBv%wU|SG&t4xkr5nBsQ>F`c@cwS*UMupK
zVe<V)>+ksgQFdHuwuY%Z#&xC^pXR>>7b<?5earlCHt2Nj6VIf@4)Z40U!C+I?Q`SD
zz>JOam{Rp4wu#K}=6qypZ?*HvtZ6ZAxok;N-yTe9X}<6v+h@VYdPa4hkEiCg?_qo5
zA9ytDtK;bw&!#2^*Ntyy*La${>|1R!dr|IEUE#HJSI6gX4LVpihm9#dpI5w2`OOP^
zB^D3sdcXc$N0F(Xhqp@@R`Gr`YVG5_^OHGFX4%))c>D9~e(~>b>qz+(?qPOKSo2qS
zonx%>aV6feq_P&H(A*h<Ca>--HfdP1(B*3WqlQb*(+;^`V+^o(vrakA^WJ5Xr3>tO
z7;hO(3)?K5AaL5~-pP#5i|a$?e=K|Lb3?K#_PLPJqM(Dmd{dUZ`k-BPtU*9@*O?DS
zW>2{GEq_04PfpF$#6`SvOhH1Xr;{Ilu`TzkSXpgYqEP?GzIE!ci|e`*pDNC~y)$_G
zx+m8U9guDL-TY$J^!e)#h(2_BvPdt~(jxJU!0vV7Gu9ov{P~uLv3IY7$Ba&)<T@sf
zu0^ao2T#PX@883Hcz#lS-?<BOxqMC(&u{5`6|OVUOX|FsmGZM!cIrktbz(EJX1~7i
z{6$#$vdN+w!<3$u8YliKsBcW2I`iGM@-NR!z0B|X^=3cL-;(JT{`^;Md))=u`O5>p
zOzpFIx&3uLiyj--wvwkec$V(_eeUg@-zLj>JYFB$zm{p8xAvo?@2t*ojK%Iwia~rG
zHJ@iz7)Lt@Z&2FwUZ?xde21-_*Y&Q=ocl+%_eu4hTMMlwma!hOvV5lbKXA_fJEu65
z?dzJ({}P!tW7*~#x9<HAR?{(TUbXG4dF_US=dSq#Wi7mT`TMVbtfooHbw7Rzh}aeE
UxjpUBI|gikjbB_=P1o2A05<;^A^-pY

literal 0
HcmV?d00001

diff --git a/certs/mldsa/mldsa65-leaf87ca-cert.pem b/certs/mldsa/mldsa65-leaf87ca-cert.pem
new file mode 100644
index 0000000000..c16d9feb86
--- /dev/null
+++ b/certs/mldsa/mldsa65-leaf87ca-cert.pem
@@ -0,0 +1,148 @@
+-----BEGIN CERTIFICATE-----
+MIIbOTCCCRCgAwIBAgIUMKLQIKlhl9TMackCFRxsAbkYNCkwCwYJYIZIAWUDBAMT
+MFoxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3pl
+bWFuMRAwDgYDVQQKDAd3b2xmU1NMMRUwEwYDVQQDDAxNTC1EU0EtODcgQ0EwHhcN
+MjYwNzA5MTk1ODU3WhcNMzYwNzA2MTk1ODU3WjBwMQswCQYDVQQGEwJVUzEQMA4G
+A1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQMA4GA1UECgwHd29sZlNT
+TDErMCkGA1UEAwwiTUwtRFNBLTY1IGxlYWYgc2lnbmVkIGJ5IE1MLURTQS04NzCC
+B7IwCwYJYIZIAWUDBAMSA4IHoQAGH0bY2WL94oVqXMYK1yn6nBL65/s1aLePQQpO
+4LLcL48a8GVAV5rX95UHHLjL1QXfZCAPSNzjxdF/lg39F5P2RcGRMQGLJ2taPa5R
+LWGvtaMN9ENBzdTMPoI5OTWKdo8858OvNPsiY83+ekggB+C9XAn2b8RUo0MrycFF
+aXEvyWRtAVJw07jJiptTPZpuNO8o9xmrGbYFpieKAQEkS0U9tOLzvZYpICK0gB7Q
+eo8ce7Mt6jqxWg2xqRiSiG6qbtBlNGEPdAJVadR4X0cHLPvv6gfkypnpPoDgJFJX
+eaQRdsKfNLjYdGRbjiaRPbWHEC81mOd0lTH8rppTs1AJZouL9cCf1GmndEpO03nh
+ESm/3rSHyyy/SUEPpT7mbiWqz9Wppkgp8kk2NqMNaWpgbrWgtsFb33inU+cQepH6
+CLLxbEiUWkAkd1K4Mnu7m9hakOBwbkW1lzZbP8oy3il6oMIYnCOc0HnittLqzQbd
+UGFW8W6+/MBV6xiWZE8lmGT0oed4n8dT35ZmsalBqoFinVXAU6TvM/6zvNkB2qLK
+ekUFCUEn4Ry8Yv/ajqlYzgcxsgEbvxm8lB7QznxAM2cCuO+AtX7G8kkpF18qttzP
+cofWgR7+9uMwqfIcnUnvubCHWhYE9qEXuT5xpKgshxOyrqc1/BohtPlSHoqZ+DgT
+5f1z48NxfVsuKTkCAaYYRAM+mwOCZfS/HDLt/49DTvZ30V0VsZF3NG17uOFeeA20
+4rj964XfjVDF3s57B4sbJb68W3GKwfQCoFohWCbe88Hy/lZTBDWnVCRHNcHXBctC
+XP/II5F3C6ziHctJXqg7O/wrR5kN7IaJelYmdF7Jggbehj3knbtdlSTK245y11ZK
+JT9CocjOfl7/tvKh9XrK1a/pEojBMHMIavTZUroaShiwfnC7BREcQZdhAzOvQMhJ
+D/sWSl9ejP+2PQi+Al0nrjxAGaAtmQgirNmQ96DmXEeRC0O554BFZc1LhZ/FJCdQ
+4ZVmSRB3EHkmjL/bDV/yOqXYQKWhEEsKtObQbImdOrT08oa8U2Im0mXsUitDP+yj
+vp6pzvixG9ht62P1MiLGeCArRvAA/D6cYrT89cZu2k1pe9AwAv9M7iQQZy64h4A3
+Ly/YqKnuh+GHLKvvWO2TP4OHkRNTlC9kVjXrtCvVGzH3XKGSJ38iXi1irOTs3T+g
+TvYwKwvLEbLwN4/B5LlBb1i2LRbY2QUNzwNmXBEAf7RmshlKB3nQBBKA7dsoNaq3
+UFCFHF3YV0n64EAhLJWkZLO5vqyEFoP9JKK6gXFJLf793xEzoPGCvVNyUBqvUzIC
+k/cNHWgkk3Bxxrw2qa9tpgUvo/AIqg4mer4CFGWpBVRms+gpvX1k8WeLxCP8qfiW
+iMirC0dVrol/7A4OfXt1kmL3uhF4pbxCeWjZBvT9b4r+K0bzcRG2UYML955aKYib
+FRnu9c3UIjVZYq/18S8O9ivugXtL7ottwy089XBC7W6crE7gvRAwMv/BhDq80h9G
+3oW6cDfvlCK5fdHAurNy/AX0afBEWJdpe2QbmwIVUr2rv8W/eFwQqKqgM6gMHtVU
+SPEj/cVAKV88YxRa3Q7ntoWqDEdGFzS1E6ts1hR+EIYwP3Kfc9JIPJ3TmGC6IyC7
+3Xa6bNFA3unDwkeEU0mZCR4iYCDLoKTy+9QQQc4fT6dBdeQ81tliRM69nMHzH5de
+mfVHBf3gvPhjtmsjG+Zm4rr4/eAuKjyNT6n/uqhJyQe72p+22bRlJthE2BIat3na
+CLYvLgkMDmZwlIPv0omvJth6qpHggUDUE37IrzLR1wEyUplYkqqsU0ZpgAcjSx26
+SstrX0fNA+MRAZzk8QVbLaHqx0cbC8KG5PPXcS2R3qNHdGecYWAzyATTd5ImN3Le
+cIGg7p9Cw4e1hky1tt08dZJMQQyCnKUYjeHZX+b4WNSP+MX3lrlz2DXTEmgUeKDR
+15TfcRIuPehGgxr6dh3lxBcrdZY9NGNcsgGJnn2qwEda2Ss+enMvzcrhbLsYSpcs
+hiUDv7ckZgfcSL9/gtGKYVh6WDmfT6VXWvNzpkZUOmTuPG3bF51oeCd7iPNaPTL5
+Amf6SzY07gK4s54YbXc3V4KtMraio6z3+BLafOeV00HT8aMKNFIMArmqgLUZvfGN
+/hkrRcLF4FBkxjtXrNNA5ptVOmQLxovzHMF9fvLwy8ELRH0ZRGqS5kDlt047Ckre
+tC8+vy9dBUBoDlWwImzvy3wZnnm0Q4UFxT5nuf/wPnn3JUSCh06dKty0Tui9EOp8
+4WQeZAEqahzdur9wIRTFbDjjinOV842Yg9v3Db8IOmSbp89rKadt3cBZB4wQs9VI
+Q3j6WlBnws62eXKMrl9MFAnIEL9LIy/DUd5fnbFn/G1KXBiyK9cQPunygHq2fvOg
+0P0GTc1IRsXuRNqjB6Mi8iEV5MciEvHaxHdhyUwkUIatHedYV7qlns+rFnP07XH9
+9R5lRoOQlPlfOdtFFUCENK2X+PvHmy5oQisBh5zBifEvcVln9HjOkbvkCwI+82RW
+EICfqjdyKnu8JgB57OxrgBb/nMRcd0S/N3KzilWWiVPQpiNaV5wMLzD7XNRy0q3W
+2+IEyaNCMEAwHQYDVR0OBBYEFBhmys7wV3j7u85h3qYNWvs2mUVuMB8GA1UdIwQY
+MBaAFHVFbpeJWj8ipCLfuwtAyA1nJ/ehMAsGCWCGSAFlAwQDEwOCEhQAHXk8O/n3
+mCdY50EySnQtMYwozzuB3pPCO4g4ph9z3R89DwF9amjBr3Oib4ax1nJFty39jsxJ
+AEbg3SqQfQobq1whIz/UKSvrpWKAW9Zj0TWDE/yY2TmHkGE6sjyF3WWbPwqUIKi1
+EOssN0MV3pj5Mddk+Ndj8aI1lYA1rA8Qji0fpugslZN3v3gzlczqgNPnNAlvGnsQ
+Drh1sO4g+E2w248V8rM+I6uPt1jBn8Ril5JSbQipSpYXTQuHhMamcR+frNJuyoR6
+vqth3MIt8VlqBMhG+60ZFBKxo/4VZeu/HQxQnbGnEYNgHNn1STF0OGfsNPliAUum
+i0F7hm8gQtexcfSo0jQy3jO52BBLYpw/JHVKGZpJscFXLYOAaNrat000G9mQyi9p
+OtXTjAQA5/6rzWl21QZtYEKeWok+p4GE+yV9U3cM8q5oYV6VkFQBj3lMig/WAazm
+luQaukgbhvr35GnPNTazsPThv+65IAWDO2Kjhy2aX6OmylS7UgmKuFwTig+bzSfP
+IALASJzzwKFx7sKKZi7x8pwyB31lzh1GNFLHb8Z8+dC5gklpEF8Gnu0Uof7xXbSU
+ecinmhTDSZvEkYcXaVfm1xAYQgMrjHbnf0tuJR/pquHAUYt9fd9HgZbhI/P88YE5
+POIwODWmrIGiLeNv3h+jDPe7JNLKvYSNyGZ/mNi3FXGqNtICGVGMjcSELQ7zNhT3
+Nv3vZ52B/b93dgryI2LJzmtvzDGKWnms8pZFx3hyE1m1BbGcTu0ryQaFNQOF73Cb
+5jHcg2ym/aIL+k7adS2/pZ6cP5yHvJfhxRU8LQOieA4KjkQYr4h38a/Ti/nGpyG4
+JeUR4rU+h02n6neslAC8YrfkjiYQIaRvevryNUNJxlxSziD6M/l6fMfSnsvFMXXg
+3uOjz3FbpT32W14COo4wk/R/ISqwBLv5H1a4gX+wtx4Xz5JpZhmLH7dQQngQfjsF
+6vwPcVUoPrsWKRpRc0Zb3XQEDL+67TiB1aJNr/xMDzwnbGUST8JBfFYe0WrMtdu7
+1nn2bPE2QmfR49Bm2xalcN8NywOebdmSBg1iaUdTDu9JYWyGGwG0G7EdqwPEqfC0
+2FONANEwy14oU7SLRhxMDbvANvKrxeiSc+bEigoxf6y6XKvFNhk7zzZrr1x5Zyts
+E9QJTHnqvAp9F+IDDsnNoJXHUEi2md0DIdNEFh0zVBNrIS/WhAJQ5A9Axmd3Au/o
+uGnCGnLGmSEiyIGIWxbx8pG+cPvEdZSXpuAyFOxOcG5lu2t9QsuPerTR1a6Zfqoh
+B2dmv+kKB39UbQPqFjcvXMclC1bETUwEGpDwhvLaBnKeb1QR4BjiTA1W8VbwJdUU
+va3KMJngsx/LmpN5q07/r3DPR65FAE5rLL1cUlDwz0S1ypnL61bCulgbAUhHfU5r
+jl6A5IMB7kLV8+JPqG+87ogpR28A96HWu06s/HoMAD0W3oKwjoar2vOBXhLOhdlk
+zzkSxOk4K6fLcMM1s21rb6aPEJT58qUDdW0gT6/oqLMM0paGaPOOj69deVlVyr0H
+xny8HxwjZNiEhjnqzHX+hm2tHkq1/cMXNC3lXGFrZ8S52tOFOkS3TfhKci+bePTq
+kef2p+HP0xY2ml11xgQBwqLShJxoyzjIIVmoZeHP59MGnGrs4zQgoyNPyQwRk8Wi
+mUI+gvP6oYPp+AglUS3oUFuA9qcMroPKBdF59V8uDYK3xj+TsoY6bWhgu3xTLEw6
+yXHEmbXCC/rzmtRobu8GWTVoODGD0MJKkWeOvHytWOf60O8ukNnMFpBQ3FZDZJGX
+zBA1cpy74lL8/PXdnXgI7J7K+8/WLX3mchZrsmDgij5Tldr92nH4RMG+v9rWlQiH
++VJduKnctOi8LEmj+/lyP3gXxec1BIBdIOPxaW8PXStUA9bXhHgpr95JDvwCZcrU
+A/fWQeaUaBEz2k94NbbdsLrHKjmRyHKA+JoIRlsEIfEkqRTBT6Eo9Pq8PGUGO3T2
+aI82mNugjSdImrZBUJLT/1jB8D+XMhdwZGoqt3jvUHpvB/oHpYFpkzzt4CsvE8jM
+bTFS50jB1uVjq9tN5EegCebyQtbfMwXeuDZ8dZgtGWPWiB6yZ98kdedQ8ufgvv8f
+vHrof3HKr5XIjBLWOi3k+WkcPWlY8yKg5yh10yEQ/DIEARUrMTmbONQNA+jWI/Fb
+v+zuR93gsUfm67uKJ1QaZRAuK2nqxkXBmdVSRLNw8hsUKdeMCwVJmMDxvOOj3wap
+/oh1d8Op3PRuy8AEKrmFxIfJnoBPXVqLMy6ffk/dc6y/KLtU/JV67mBtf/Toy6Ti
+3x/668oZJn+krotqaSO5bGcl+En7NrV7VW+OQ/vtirXlyKzGvp2ch0bY/yI6aH25
+hI01g/ulNbI8otZHTU9+/TgfamTBav3HFzLUEyojdKMVXMh9RrXAbO/jl6Z1trEr
+7NxQn6F5L3Syue0+zZ8SOb+M7+mHXORdIy6J0TKTqPiJXGnaEPYEIpJa6utVjgCF
+oYw4Z1kQMNGOvTGZj+aUld9iJvedAXp+4UWzh7GWWwguIGlar6o5tZ/QQG5gFTOI
+yR4gL2V+6++mUbPzgnkicM6tGY+n5Tqp6zXwoaCZlgEzLbra456Ik5T65r2WWJ2y
+qRAK6HERrQZifiN2X2Vurn2qiDhfiIvONarmNyuTI4Q9Q5ICOcLlV5GJr5iBmF8C
+ZnS4EwmLSn/UVcp+D8LYbjVoQp1cdcqUOPmD2tzY36YTqUnxUnzXevT1LPFa8bKH
+gfJ/4jF5TOq7ZSGA3oSUEDVYkRoLQIftjs0AsUEgmU5q7YWUqmRm2jQdlHXvnje0
+FpqmlKpUo8VeRlohgvf8VMW2kgFYQSIUqywMwCMJRWye4YPFc+MYVTIZpRd4ETGa
+XQra78UT9kggk9mN077f2dtmZXBrUmHN4+X3X+gNsfqj4EjSesxQC4LX9vjtupuH
+dX53tFXKeEPF+KDDBcS78uFHlYlkDWFJRlVq6Xw89uL7Ijfan5DYDcuDAcbYY2uH
+sPhMwltKpXWUN7/j1+VUoP6oCgTbjCRW02aXGJHItJILoCQ00QoTgHruFIR5JiQK
+3hUF2lv1KN9hLOkVmEdHKQO8l1xxZZgTzvrliSdA8VtD2efroxXA48I+dnt7G7yr
+9lIY6cL7xH+2w3JYqRHmhHRbMi+OvkgeO910HuaZBG66+WL4tlkyiHyBuI44SjnK
+vPnk7LpdAaZ2L3xYeDiFNyNg9cs4j3iCf2VxuOwqmgmr3M8DOfbRQ4/cgDHLLPYi
+Dwa0WxKAmOYyTmxDh9W1wvXrutUEfIYoaIdr3GARDLn8wXozNh+QSSZ4711VCR2q
+HyPCobdiXEs7qydBtAVogxRv20fOkFG93dtp/yHC0XBs9JLNCgwoTtXItPAoTXKT
+9XLiOiBcfoFuN9HooMwAdpVYWo71bCBXbv1eixweFOzCtgp1LSsSh8xVNpAzjb/i
+rOSBW6Ayk8ic3zBcE0aCJRHhEC+V1aVyAD6yKZz3gsvbCOB9gg3PAPxBBPjuKxNN
+Qwz41xNGrarkbnhXFlGgpk7Qnc5z87H7orVfxl3/OmNsOAXkj1H7c5+gIqw9ddsV
+ay48bq8dzBdxfJNReKka5F+J/p1Tu79JKhc2kGbKkaR9lI3SP3070f/UHAapv169
+ENkNQudbLxqfEgqoKUUbM7CuMmn0kB5wuUrPKe47OzzQL3aCB2vcNigkPBUP6yUf
+FiM2JW8aEqAoyraG007mmqG0o5OBR3s7ZefdURvU+lc/AglLDhQj/EKi/fthJuCa
+5+AuleTNKrzcXn8/ufxhVCkvEgNzdQwopXXP9PWKX5Yyo3/jKe/2Q+2tblHgb4C3
+AX/H8xoRSD2kycF2AJoK5weyn9/3KvCjmzpDLWDDiiAzrarY9onN/V8XFNTVQEe4
+2hknuUP2+hiU6fBjvbjVyxCgh+cWySc9bUD8nTroQhWEAyqXM2dQMQQY7o5CWvWo
+Gdh4aMCzjl2QJL+Wl5J7AR14yrwHO3Qe3zCPjn25zhb+qPSHPupXMGz6BnH045Ch
+dYlUeP2YHOqx+2J1a2VEBzpP3SP9knMmD/U13nkhYIDFgVhrCc8gLkk+/gH/fxp8
+U/IBSx4SZfUuC9MH+qMohcMrRvd4CVJglfFVRLt0hMMioAsL1BxaqRIShnwMAGIG
+GJqj+w0Mg2hzuxFXA/+K7FWs373KotgsAyVFAA3GDUP0Ml0JlwomRINT63koEv49
+PXUGln60IgUVQxFPHGo0UQM69E1jwUzkNiw+k2DwvrKbOMyCTQsVAS8TaPHLDLux
+N+SMmxcc84bNvfiiK6N6ilFj/Z5KTsJ11VY4zTz7tqjUMJeTLgKrcRz7oSDvTD0/
+lqixzvTUaDAP0mqfzKjV3WI5JXQouvX84Q3XDxGdidDrBuU+baQ3o1GuhVyQga9x
+bSUhC00muruoOKNaff4fKcpJgjYtkwbR2grCPG7w8CxE04Mb2O9Vh8Pd6As6r7Sa
+xCmtRCjPyKZn/iR1FsmkpRWi03p3M5RQVjnnqYfMpiUBE1jm5E6HYkENvxL7Luag
+4gxYCfXWXI6TRVq/qQFfmRtM4HzU3Xxt3lxB6qliE/omVNnKi6KwTYyioGZPBllD
+rv/02uxFfCbT/7IhG+XwBy6+hTfFVrSVTobHsyhPYuf7F/vt5lM+ctedGWRX+Y1y
+VeKx4Jz9ijBxfLNg/JE4TxZBCwVfbMVISr1bRbe7IZtKIJW8uhz/jty02HlCC3BV
+koDYiknMC1cqQuShci905iIkrkaFA6JkttAz4xOqxlZRiZVCVCfOnPT/ez7Rmxh6
+5yJCg3tUnEjpVmbjvFnSw1ve20Fg+6AA6wVmazcyfzw6b+hjMiheDzGwtwpS4mzN
+tUXvcf3PTY5C11Yp+GxGTUufdmBGA3VoBe6ITRE+iaolPIYBvXEVdtLfU6u7BfAR
+ruum8p/QMUuGOJNY7c4MJ92nHAjT/dB04EefzU8FwSKk2QPojC9wSL6Ltpu4hoe5
+Ci9ngP2B+KyRZUy0gWx5IvoKQX6GEbPoMF59+F3CdpmND2ABNyuMtYIEmVYZZjxi
+Mok3DM5yvtjS0iEaOuF5i7h/ZK1Gu6Qk4e+lDUlEmbKBO1BtjhIPHjVAQoEYKYu4
+RHx5DvrtpvT2JbK1qW0K2YnW+bVYd4wRd6GU2hkiKeSkqFcgk1jZSb/vTvyuGsiB
+5Z3qUdcNgH8x3DfvfEALM3lFI2gZyBLAPJVI6OQd9lWERSZkuqMIH7y9TAYi2E0A
+lJcRiA37gwutFP0Ak9/ir9xP/CNBqTasAndcRZkqDin+oNB4+Tb2afDNUstt5Eli
+o0Cek3/VkuBm84HxUWixngJlL1i2FJhLCeI9Pzq51JqWXIZtBmIa9uCUhIPQ4GtM
+oPF/ASdM8cqdh7wG5E9RxWr1QcuESYKCQEWx7Zt8STdEvqs8m6JtpS0TrZ2rX2+1
+UsF+nAYCX28NF34j7Og/IgRIO39Oj21BFJVJw7cYMXoN8TKFjg3c+QNeHKb1hV8/
+z676D7+GiGT6V0g21hMp+ld+QV0jxyINdmJ2hDJVbZgRNOreozSArKFE1W/igNLn
+ZsJH1gFQOOyuI15J3tM0paA+jAHaMpZWsxNgEMsy3slo86N/VJ/xdutM2BmKXecS
+MqJSwU0OlKTq8Ct6xoAQFbrM8DI25Aq+p++WvGx8lWGiDR4CUhI1y2Pj9D13SXip
+ezF0IH/8P4WVxtGui2HlIZ7buVO3ruTXwsAdhPuD6KqXn6/AFeFC5KIuVTk4YcwQ
+u65XmK7B0/PaSDNLjUBImIkSY34CCIqiBQzByFwHv7wLw59if47O0J0KTMhzn4SJ
+6lcskUoazxY6I+bqPicyLH4WmGqb69jn6FZnppMVsVYi5XUzYfxwf4FllZnulnf0
+5jVKN99OjWvjb7RpRlfn+n2HftAdn6dR9JWOPOm3638ELgYKtnTl2AylvvvO7dz7
+NKcMSOvGv60Crksr4mL3BUNeAXNHQiFSDoh885l4M1tAE7Aisu8si/yfQLWJ1y7W
+mZ38HY3ke7zaoTqRdgXEOjnmKf9RnP/cyggjP36Cz/oUlpims9ja3vgTJiwxg6q2
+zTd9sMHO1kxSaqHR0/f6/gU1YmN++PkQFD5wvNuWwu4AAAAAAAAAAAAAAAAAAAAA
+AAAAAAAGDxcdJi0zNg==
+-----END CERTIFICATE-----
diff --git a/certs/mldsa/mldsa65-leaf87ca-key.pem b/certs/mldsa/mldsa65-leaf87ca-key.pem
new file mode 100644
index 0000000000..585f2ed1e9
--- /dev/null
+++ b/certs/mldsa/mldsa65-leaf87ca-key.pem
@@ -0,0 +1,88 @@
+-----BEGIN PRIVATE KEY-----
+MIIP/gIBADALBglghkgBZQMEAxIEgg/qMIIP5gQg9bb8CKQdqJ8OGmW6U7tIxwC+
+SdcCmwZCMghe4+TbzTsEgg/ABh9G2Nli/eKFalzGCtcp+pwS+uf7NWi3j0EKTuCy
+3C/TZeexoTs0xJ/ax4gwC1W3ediBR7yoTtbeD2ealXnI5uIEr7f2dLK2HdqAPq/e
+Y4ljQ6SHPa1rGZeDqfFaLeimqGgzX10U/ti7eIzHKxG+9K2gYv9Zmtpbtr+mjHid
+Nc9gIRVBh0U2J2cihSiCZDUgYVaCBgAEYRRQMIEGE4hWFyKIQQQiUSB0hThUITgj
+VmYnYyg0VTgXgkdlgWB4QGKDIjQFQzRgVWUQE4gVAjZzdGYFh0NGYiZYUgB0BxhG
+MIhiI0UFFng4NmBhESZzMBQoA0AndDRxRGA3hiGCBngHdDByNYdQVRMEBTQ2c2dy
+dhJFYzCDBRZxFVEmYCh1VDCFJCBjJHZ1JmhWglR2ViSFcDQhNIAVAkYHAiA2BCMI
+YVCFhCdURFCGIwaCVYABNURxQTGAiFV0FlRDKGIzIBaFBTQoKEU4MxQndlEIQwYG
+iGRSU0IoEjeCJBR4RBYAUiNWAmJVOBGEgxAEcBSFhFN1CBAwhVQSGGRSiFd2dVFo
+UIUjKCJHNQVUgHMAAEBFQQgmKIcmURWAVXBCEyc2AkQBUHUmAoCFRVBHSHZod1hi
+FUdxBjRwB4h2QBhhciIiiFBwU0iGdzR0NERBYhAUYoY4ZmIRZBiAGEWFIgUoIWUY
+ZBJIIVJVNEaEh3EmhRR2AUMIcEhRQACDIDhyczWIeEVlMlcFZyQhZyIgUGODU1h2
+KAQ4WFNhcoc0UoJ2EIEhMkglMmNTNiBGIgFgRYKBaGZgQ2VkdHQVGHJoNnd0EzEn
+FjNmYnRiBVJ2YyUQdoU3hHIwhFRmFjNXWGBDgYGBUUIDMDMVFBWCFzMiNiEUdUdW
+JnFRYAIAKEcoFjExVRRUYDAANjBEUVGEBHAGR1IzhlIjZnCHYURzZ1CFSFhyMYJI
+RXMxVgVkODhlYCJkISBXZiEzIFg0RiV1Z0N1BWaDIDECcTgyIzVHA1aHMSQVIIYh
+UnODdCNgYVIxFVEoVYI0A0AIQoYBcUEiQSgVUChiQFhSIzVScCYINUBEVXYjYyA2
+Y2E2F3cIeDIhFIIkARUSN2UwhUdUAYNwAQhxNHRUgQYhdIBCKFNAdxJgGDMmMCcQ
+ITIYRQBFchc1gWWAU4JnBgaBhxcQhYaDRRY3AUAxUxVSdWGCUjAoKEITd0gmYFI3
+JlZCARglZFWDUABiBUIEY2ExNVEGgRYQdoVnFQFxBkKARjAoAIRFFXUUZEBCYgMk
+AzRREyEncSEHR2g0gDMoJoYzQQR0SIBUIAIAESYTRlCFJYJEQERCZCKBBnEiKERi
+FnZyEYYiIARYNyBlQWKHQFgIUlRBBGJXInJiEGaCF3QliIF0NySEeIB4NiSEMGQi
+N2hjYwJGZ2RzV3RwKEITNAZHJTYCOEZYckgwZQWBAhASFmhzYjdGMziBgoFwMHVY
+JCQxhjNYVVhUQkFgNhKEByUhYYQGiDR2eFEjYCBBMoZ2hAU1BABWF4c3chgUUmQk
+MnYHYiMxcyYiGCh0hDAyUDJUhQBRJyEQEHBWJDGBN1dhEUcHUBAgIGESEwFDdWV1
+ZgeCQTBTYkJTEzc1cXMoNgFVMhRHIBdiaCg1QBFxMVIzgHF0QYc3YkdzNniDEDCB
+OCIHZ2NmUENHVleAEQYoSDhARISBMhRgIAeFEmEHI0giAQNCMVAIIWeHExZoZjBQ
+SCViFjdVRHNlcVZDAoYTFSNSVmABYBNmdSNCdCWHQ2ARIHUzYiEzNVYRGBAnOAN2
+A0BYZxBxAmURiFUSaCRgJhU4OEFAERQIBwRASFZwEEgWBBUGJBQjNIdYN1MRIAUH
+EVYyFEZEMAg3YRKISEJ1FSIoRFhiWBZHVlaBUUhXcRAzOFYoCGcRQiUTGCMxcAZS
+UhYGQDAVECRQMQQ1iHViQTQRAAGFZUMyUgdwgyBGGAN2WIgABUQGRWNDY3IjICVo
+RhcHAYMSKBKEKIdDRUIHRAR1U2ERAQFgNRYYFlMhVlNlI3YRhYQBEWRoVVdkBUdk
+BUMwMjIAM2ODeEQFJGQwExBBHptYDUn9ALQD+B5xful7QsVQE40NSviJdHKiGAPR
+k85HLNr8ozqu//FynovfNl3F1RgPlNjYzp+pXXJOvVaHazjGlj9Y1ak9KQGUVJYL
+xFJvqEdoc0ixbC5Sc6KLyOIZAK+Ppw1uARlTZH+0CBBIaHvpCGFz4tDQLTX+vRlA
+16Ul27u66FZkKEVEuYzHo2fX0mbLtmCX5asHc5t72dyCoHwYl5gD2aAVvUr+cgvY
+yFQD5DXbr97RXzFmV/TT1JfS7PFlGq+X/jjUtg+0L6WKJ6CBDx1a4KBPyyxL2VhV
+AeOm3UPP99GOwkCI2FismwD9zUDfqpc6nLxRxaiAOcBtCOppL1VtGbZV7ISk3RK9
+I39hVHaGvbHeOSTbzAggadoM1wMp7/LA182AAVNQKU/ONMlEikuhgI+XV+en1tp7
+Lh5Hlm/sclkYOIMzNb0S0o+Ufyvl8noayM3FUJUGB1YVqjgSyZITj4I8zTUco9wX
+QGec2Bsmzl5D/4+0g5LmAChHo427Bf8Kv6HA26cuwJ2YWPXQqbfkhOTryiLs31VZ
+ppGM7o2Sn/s79q4DXnurLwKQvnzoAXMibtPbi/cZHovMVvBzV3aeOgJB0uQ6yaXK
+Lg8LXyEVE9c7/1ViS83z9lZ39mLvyJSJ1SGgpg2/4dlXlQ3XcUbO2g6kc0NkgnUx
+rjOzQT3C2126+9GgyBtmjv0OAh7n9aSIsvuutNiUB2/4nkV1KOefcWRcEFMt5WYn
+HwoDM7oO/ZDY6eEPJ/A9xVY5LxML7cjAyLlz7Cp/TXQBfg1bAaHF1xJe7MoPuEC8
+ru/xADgx1kid7zTE/e2FMk2uOwWp6JLZ+4YsRLpfjh3dgfPXc145lb4U1Nx79Qy4
+6mgQYJSV6FbwRvcRns6tACIDrvU8PKLUW8U3B+keuiIhzRBUUKvoVXu/cD9Ag2B/
+ijvl0BhZmDUZYrPrbTLVkThGwYy84hmdN3MH+GxOH9qHLgpu83Wlh2HFTCEfDSEa
+/75IQ/8iDAEFJZldKnL9B6jMPCj+aSpY/PbC9Pa4O6UXec92I2M4DRR1OQd4epev
+nT6jWvmenr5X2G6yyEUmhR6Fduh6GgVeJvNxE8CvLTW4PueTODOu17d/3lIPErKY
+Xn6Pu0rMrk8uEkhAlLUQfkU2XOVX4szfi/2OmpidZSQjo75POjo159o5dY12u3Eh
+3M5xho5qLUmMOmv+M7rQkXcj6uO5VZH/b2+txp+/1gMI78zfht0hJGZ0SjIaeSSx
+XsgRJyPS/OwGE7tkJrht3RFaBmEkzj+jbWoitpTESP6yZe8MSAYv/zcLwWYVWvFR
+3sPVJJBm8Yjo4LFt6z3vXu0aUrLXhIMThRCWKEnkJdrhL6jCr5uA3qMA0pzqjZgd
+sltKTnRdVG6t8lbxeQxfIRPzn8ijXa1vAn+sjLXlQcxdsleflYljQPHeHMYBEoHV
+5PilrnPANTcE/XWo0ZOd7MTO128WWmASAGYUs+L3aI0K+THV4DtRweuTjpWr1iHW
+VlTjPv5LYw+rQIUt/3Mk2XliRhzyq0C3i/KeWPplsdkUgDIJRHOCKFSSHeoxdq3i
+9uS3y26p0bJkMuRPrlto4t6f0yK+w+sWsXWSmQh1O8qdy2FVbOhM+pDXvUS6N9QC
+sGhq8PnFjbC77LC8F/EeA+3MEo4Y11wDJVC7bvGrZC6XBh6kV/8+nv+CMZ3X42Aj
+S/YXiE5YgjhrjnQ7GnIuzvOBWUQzXaifw6YcG38tSfcfng0Z+1YhhcjqhihwNdMj
+WzHyyN1RbsAoRwkRxnYpudhJc2Sfwhyn+R58dFhIZHr+D7XSRa1YNv/Me+ynjYll
+LwWkwETWp4INf5sY3k77L6531BhYLcmANnsEM56Cx9dVXC89Xlr7LQd4jMfnnaq3
+3T44zu3be6MN/LDR1qfTp27tTZUz0wQs1aX70eg5kaffUasLyAuqrsSWPbRWMfKq
+gMp6yhS14KY6Mhx0u79bHCjMFMDijA9QjTdchM2m18MM8A9dtoegekCCuDGGq/rp
+AD+lx3o5740J6XFm1mQkx/AMqViNpBgBEofOAkdwSQCffk1ToqL8j/cOKH7mUD9X
+hlKulhNK/5gU3Ks00CnX1883hJ+zKkn60/6frzVks8mD3xLbvG6Ze2JwBKoGlvha
+zxa3uDrqQwW8IUr2jW5Ozgc+SevieObaMTsVkUrCinAvUajNDF/yUB8/xYqTNzcW
++MsNZaaTVtAylX7DUk6E9LPqRsI6B5AMaHXztlrWifj4gXJdPqVY0pRE3QpUCCm/
+k//BvzD5wUIJyhjr928WzLL4RvsWlAO8ejeajiOaSkt0hBB2UBEeXjvtMnhXXCoQ
+Z4K10D2rjjSUAIrRgQL0sJjwvpnVllVRMSArbFw1nv8TguTADsNNTzX5jt95Vbkf
+2ibjI2nkWGaYef6YmtqJg/k18oQINI2ht707vbuBAPEQjhDGpxNOj7d9IphA3O2f
+42o9dhITGQ4Czna+xuiF76imVd/PvHH+sua2X8OWhPUDoSsPA7qBkroRdauTrgIC
+dFElJHXq9buZoTf67/qrfnQgLYFORAeNMxjU3aYWB0+17ndWLdTmPcJ+ZG01rQS7
+3JCnNSPHidjHhpcvhBVdeMxCuaVmPa759F4ivAtItIs5eJn4Ylcfip5MLG2CU7fd
+2FHvR007d3PyV3Cu5SeObecwUriLUK44ShFQr+d33uox2M6EF6tEt5O12J3q1Z8H
+mF82Fr6PwQ7ExmgsufhSJ1v3EzrXxa5UNF6FnOOJxMhKK0nS82vZfAbniNYUNr7T
+Yh2JasgK6ntmzmipQuMuEEb3QfkmJoRKjZimfSW+eAVWa/l8O8QTbCIGdMSg/NC/
+mJHJgzL79xfEqQNP0F6XJCYdurzpwFNk0uvOP67E4Ch81zquS1j7bBU6bQK3jDqC
+FklLmKdnNxTD0eKQqFkx027/nQ1zFwgjDk5w6ZowRECPDU5igVvL+0ct6GCjTjrd
+EPyiiy+Bpp5t2D8iuGty4ymsmFcjgqINTZlMkIFFOqsSde3gkKnwvljKQut8z42X
+/mlVAI6xCyP2Ghv3o5YrWGiBO1/HUUZRDXBzN+l1XRsHUO7T/UVrnth/NJfQ3281
+sbPXosfZfmPeBMHFm5mZSj63ehHb7LgHWVnyR428aokSGSJbQzfU2tyeQzahSSEL
+sT5yYjZeE2YVzbe9jl034XE9Kd1JSUXH9E/PFH5Es1bOozEUq1hvbtwkZJsLcFDJ
+XgdFwxZmqMDChioa/SUblSZV3WALGY9BnLpHag1LFUioYNCgo/BJFVA3Qo28veuM
+x3xEc8m8d3x3V/PaAHOF1QaA
+-----END PRIVATE KEY-----
diff --git a/certs/mldsa/mldsa87-ca-cert.der b/certs/mldsa/mldsa87-ca-cert.der
new file mode 100644
index 0000000000000000000000000000000000000000..64a4210ced4208b56766e9ea8991208d6343b1f4
GIT binary patch
literal 7608
zcmXqLlHFp^#NEAsnTe5!NhE*H51U!PRvXsj?(}S$o_4Zbw#UeTn~gJ}&4V$OnT1){
zAj**2fRl|ml!Z;0DKywnz<>|L;oxES&Ce@I%u9rcu=B7x<yWQVCg#CJxOmvh^K;UI
zgMAD|4TM3un0a`7eRN%d9d#|t6`UOn<ivT6%nZy8EDbG9Elka$#CeTDTr((_rgk@R
zp?Z|LiA#~eWXH1gziXz6FIj7}x5)Ns%<rGO{C#HXE^eK^>RR=zqoLu`@5(gqH>#fV
zO7-ul#y>X6>_uPByl4(yQZ~>2)T=+)etYYFImFn=2L3SiWWTPQWa$6kS$3d8b&0N9
zqSumL>=VRNdlp1rb3Lq>y}Mk0!`n|GUKaAdH!x<cyKbyv!E7;;%emt{kNTl)yKgLh
zTF4tb<(5d`4Y@;6VTL;eEIs}CBGgN{AGFMO+Pi#r&+A8;zSEV(s{fT8TXx&4`^&4t
zTOTg}6C5z<<b7=o;j;_x*FD~AIz=xa@7A5y+{#LgYF;T?GndX_%og*quvM9V(Pdj`
zijhstllAu(t`u9ndf|eX#XEL+9q@1MUtyYaI^c~2gOq`ij(2Y~bLf`hUqR(<jL$@7
zWFI(bD<iST?`!Q&3zmm_w9O6PM9JIE*qV31T;gh^Q?ui>);H?|uH|=rf5IH=Q5di$
zfZzW9nlexCMYH~M{aSR`^LT=^la<Df8&l=YokP8~_w4J|=;EAvD%yVURi|ztJ)7O(
zGi6sfEn#L{e))Dr)_KJRTe*2}-YW2U|M%jZUEb+R6Zv+m+$!2;yZe0Lvd9(3mpoE1
zcQMGFa(U%MSt(^st>8;%Dx`P#{3=k-{j!!LL*(4v_|#seWC{6gOUe^f1<uy#KV0>{
zeQzOW8n=k^y4S14iw@uHo@u_J=+B;te*Zlc+Tr{L2NyDM{l8UnHX!to;?07p&EgM)
zA8-9-&YCu*)NIC+%{(bDnH=A$UXAO{m1X_;e?n=A_^G}VrD7@)+;<A@%q+5s7JB*f
zHe>R^rauQtR<E1X)VH@{;TI!G$47CquJhI@Y{;qGa<IoN>C_edt9K$C4lG%8Z-HU^
z<=%?qnbWHFWF0v7efN#(uRAwfx@6vaENH6XB**Z3ht#$!2WhXn8oO-T7uyL+#TI#Q
z`Qx6iRx{qt#T@Q_Y5UX+$pYK%k^;Ac?AMAF9QQ0NPfrsH()rIW`1jZK%HD3ptp3j{
z=6!IBmo=3ypRe5e?ZwQ3)So4*1MVEG$|>w{HHeMjv?+8<JoQLp^*5FJ$BH~Nl+HyQ
z7GeoZSQdGNEmZ98RfBmJLbqfd_#bcfe{z@i()0(HydJ(*So?lbcwYkNQw^C@dz5Qu
zONd7O@X9O7xtsR4dE0KzUk9a4-0i=z%`*F;zj5;1`?{ISU+&To`1@e_854nHxl2?W
zD<AsaTF4=)>^`GrpGovG&h>L$?=6>ZlJwkMn9%(2!13nkv-hl)+COK-KWh`C8LZbl
z_D1YJ*>CYP_ptPJ(OvUD&0NYnrM|ajZAoPA${+XU3ttPpaMr<Ws%`xTk)>ZQ@^9W|
z7kEAC^baM@AMfmpGI{ppUdm)#v3lnpqr}xAvGca?y6f@R?fIv9llD5rl!#>9tzWx2
zzI8owuC|Eo`-oc#<rRx(%S~Onbj?$}AD<qDl_twv{dai7%A*B5TZ<O(9N!-kUGsaQ
zwCZ8r?~QRvxuR|>_h>LEMqBP&a+vLZJG*=UYqI*R$^QhG+&rGtckT7oO+J;u&H+ld
zLx0L9&oc|Y@;!Wxh~vR9K5>zl{aw4S*<QJ`<5tWUS!<?l|Ia(8O?~m=zxk#uGZWV^
zX5D;!h+$I7iYSJF*{w+{x@sRuiQ7(HzptZ3H%j>M^?k>9mqq*6g>xilOPKNRmem(_
z@Q+jt@9-DDxsUV02?MLeS8VeBEq$oG+UHx&X~XXH$aB;5cqUu@x~x7)y1v=s!Acjk
zV|)D{-Hn(3c(P^p@&`O;&hdn_N4m@OWsA=}thX-p;`51pYf5h&;e7k?m2`na#7e`J
z^LRJM?D}`I>{Vud-uxYZ-p?p~z$xA)nl{t_w)_8j-b$~g{r?mf6$qbt)2LmzN-n^~
z&B$%3<*eOz4|WFh3xDTt+`oKttL*v*Z!@Is9-mieduBPuwysn2gsa>AR`3gM)(rN0
z^5Jt``@yFn;U)21Q6Eee`$uli@Sm%7I#uC@_5?rf8vnfechk~%v+NkIXbCX5-u0eh
zUACI<=$D(Pv*u4q@<?q?SDGiajyu<~H}>OXSI<wuRh#cCn6K!tXjHo)v$`eSv+=L*
zl<NnlOY$|{s1Du4dG7TW0T1O}C+94GQk=7F{f){FE_chLTfQIT-hSk&#zE`LxgEam
z->zuAYMZOOWA71GDc%d_d^5}1wEq7#S(D}YYt<<Y?PCwV87rQiyKLQ`$^YLpg&Jke
z3R91{mh^JQyfv@0mDX%c@mW&Q_UyiU$z(=0*Hz40v}4M5FO^H)8uGf&>X>l711rbu
zbnUP;vl1s)sh!-`P=7mT0qenAQtd0A%vqK)N%^yr$cx+=o2xZ-UPWGs^>F($Ys((Z
z>;L8B4*2@tpQXK8Hj8K19;GEM_h0orC=c79;>5Z;>R?{6(V6{9sdcBN_SE^jaIE7x
z@+O$eUrMje#qH-A$M%Z+uLnBsFiNdk*lai9{5HkKuM{^VKigY&_}Vd#O#Ob}SzFlW
zM@CL(IcY8=`g-lP4NqRmD8_bvV$*qTac0iNI#WK6Tg-djSnNM@-Ne^<GiM7E^Nu68
znL@em{(I1VJL>aX4Y{WM^;IDs4t;)6Q~1#L$p1g)nPIxR>n1JUw?|y$k;0X&IhLK)
zL2X}j1lDIipV8A2#8;HCiTBLCZ(_?Ih;5GTYpMTLz58y&X;1qD^_x@fe^9He)?Hb=
zA~VmUxYE(ZPu=S96SbquuW4%wXg2jr<{#lO?%J_u$3dlxUPYFBDg|q6^?YqweM}XW
z`7DSC2~hiDE1=qXH|^x6!b9I)t_eR_VDM&o>Bg^`SHEO^ILSKeP{ZRQ<LLciE2kE<
zi`8T$9iICn@VE7w4{KH{?`{qbT_YYV>e^I)>-n4-g;m}KODtx$IPY85{9MZN&^mig
z={cX<VrT9U&sIuYC&$~zSe!Baw3Ub*^If}3CI*|bHK+ZVxJUKqQIW6zpYo;mUN{@`
z*-xZxk>Pi*ht5yAoVqyos=T_oRP`+Xx_cKYS?3yQ2Kieu6yEz1H}`<{5+m7d8|t~m
z9+>4XxtH-!OZZZH3zzF!!Byo28&?HRT5qx9a-={7lOI<{V%XE`x8k-mX==>7VK;AW
zYS}Kgx_xU77_6>KTYfRJZ}#&K)gLA?{@J@*T&grc>fS-0XMBF2nm0{9x};4$d`Dm5
z7ulI&1)Zvq3c|at)%kF}$y+6{XKQoDi^zMKFVFA#_C44uXP#o!|F{oV4jsr2&PiGI
z`i7E}tY)MT`|XnZnFp67cHWy1eyK0xV#Th6W1^l_@?6r-#l1Q-Z=Um3n6BW@efRMK
zfhPTBABB$GTzFZh$N2YK50BfnlNxiQ8tZs0L{{7sFPc)tTrkh#%PjYdo?F~Pk5f&%
zrk%61cfNP*=%NSrYD(lco@o9)?@pK9im&-wrv&8RxTErNgFCC!YUR0qBip}oGulW?
zrZu)OfBZ3(-)-`u0}(S*Q)0FD@Z5W(pxZ8Rw{zy2Shr&$F`>6Fe|x>Y^oakZpH-8t
z&Y5uX*pZI8cTV*jk+k=^H`n-n#H`L_CLRxiSIf41pY(Zass81~!3Kc_vTV$uvV1IJ
zEFz_@dDA<i?3I=%-QUgaaDq2o{rf@#d62X+i-dt#19k=cAO*sVjQ?3!4VW1j|D&|G
znVW<}7@oTG<@}v<ChGjugKVDtR&Nz8Sap4v>!LC;pZ;@r($1-opzvVlE{5#D6_;D|
z_U)ayhP}ApdEkB7iz;mIB%ZM6HqT>HS-4Zr{NUPD`?sCZF>Z_Zc5RgY=xffLyGBnd
zQA;&aQQlv!QGE04TE-Zw47Ni7nq6lXoLcqtXock}{`cvAN`F>mr9OE1I8m-)ZE$hZ
zTh+j&OZs%Td!A&v^x~1<8-XfOKi1PS=ZlNdzfH|M)gN@s;)~QnmuvpBuijs{XrkTw
zhrfg*-fUFUVqbjh-G#3|TNy4{8CSk3-PbW|D#QD=3+@*`dlB2c+D`4`1~;E0Q|u3=
zP1O7S{QKkBmAU!Pg7&7ZUeqf1EOw^r`R*=H3BT!K3ypHM-Ufute?EJsw&<nH?`An=
zrCpLgpy%Stdf?k0kD0!1PSaK_zsR@Sz2HXyhs~n5HO=g27RoPF_x%_7?ohAFs?x-~
zb51W`6vnIl?TE~-VYRkgJd0yv2<ryb7R`beIqDWBxo@`%Uz?e!zO-R2@9Vm}C!b%<
z*`4vj+WY^-+e_pb=c_eeHncC&I#tkS=~=h(e#SD6-l}JTl9jUScWN#;dLzWA`tk$E
zrC(Gw?2oL7{qbz$H8V>E%gp6F&$j%(x;|4_!++Z5AG!^b+ou+^FFj+lvOZO^&1Kfg
zZ~k`Xk8*BZSayKB_}0uhpGq~^CH=2&)R@7y&2j6shzqJB97hi=F)$GgQR#|sce%AU
ztK#IYa^5HF{`JY~-2K9OV8`i|?EzVW5xaa}zm-(8l=Zoi;_8qS!}?S)s%6zqw_vx%
zIW<pgLX6!b7|L>vWj<e5dN%gU%{Qy+^X3J*zq2!8TFY!Sv3h;9((+yB&O8;`on~Fh
zlC_=po%#joev?&2mioKuDzcv>%omAld}+BX?n3?2&VPA4*B=~o&P-}b+bHI~@8Xy1
zzY;f{G-AsCuDv-?^6~ZEd~fZp=^XKEOWv@jvE5HE#X0N4ESu$T`mX-UZrZ+Ufkm=v
zNwAHD^6x2yk8eDBv#ipesd`=S(UmM#N7cGE9aV~(9CYAf_@DdBUW)p5KHYM6R!_uI
z*Hzco)+Ffe6MOA(C47pF{t2@uTi)zhIqk(=Bgc91k1XG1v>&b!uy~Mm;Fqjm3)2>P
zrrh2O*JNG4t$6*R{-Bgt{jNoEHNPzw_-^lVNxHAK?cS-*^tFqxyyw1HW4+*Z&Fx1|
zzqc{RMeR6e_4i}UicdT8{-=LqKiX0deDcEVB*ErslUI72pLmDIUGRzi@2`xh+%kDQ
zGp~C;OEGrsuu)&_623~h^ujgvwbQqhPFh^sBYft5<NV_Ev&(<XO|a~=<A~}tICz0I
z`PTU>YOegV&xw{qPpoXSoBF`!L~nIc;@Ue!f<K;i<TfaJC2f)0b9k|6;Hw}z(M@GW
zmln)UYnyDAygImnS0w78k+t2A8TSr-<b7g%uTd|5=I^dso3^;GyE5UU`QrSIp^Kjh
znlpr&PYgQ6-LS~HO;W_*cG%<J8?JwC$`o=^lF;_vnN*dP*!JMXj-MSlcMg3vXNsye
zUT3kC`Q#GGnce(%XTLtb)@}MR&yU^ezj&oidU|nf*lt+Lt>4mrkn_sZiUmKCV|X+Z
zLofFQyl?6M{^_t$ZFYo4<R|ZQ=Qq#V_<C7UQ;qSjiSg&uejeMWzD3f>;i0DAhtzF7
z?-#|CmMJ7EFg?B<`*KsB%$qH((;xo$rg>7LGICa63D2)@?x{*zhZ;gxPN|DwzWu6D
z@tDxZYnS3KD(;wNCDprf&-IGcn-VN{-p?rCU9e1NmeA!lTMxcem>>AU{bOCzN~_6M
z(wZ|{tUAlme9C96dKbD`LZvYM<zAl2!qt)b>fPdd=AYK;xfr3y7?b^CPVdYLrq5s8
zDxRqGxIDk1zVEGfp{I|}$)2UPVN0VVdw;l!DFj@z5eyc0|14qn-LP2o?MurwmCsE=
zOU0D0ZF#lq9v_EuykE(SjIRYJpRUMFu6vdL^2EhR-U**|kF*8eoHO@&*Sp;-3cd%%
z>@s@KnfB-}x7?id?G{_#mX>*~7pOPX@HyXXP<4Ces~ZL}2lKwJbYAoRmGIiu7XCLU
z56}B&S-GbuCFy*I^ogH*$?lU+=R7)K+Iad`$ILyGPj7tQ*xWB)YH0T(XUUBNTQ2T+
zl9fC~GC%D7H%XxfYX##t-IVn{PrGX9p?~Vo={?K&UMioxDtj-%L2v7?(B<O(*Uv0c
znjmVlD<VQX^$6GM>l*&s{&;=&IsP$u+l`OsIo}9=JovL-xL+%RiOEr1e!^$9@-H$k
z>`NQ!-*2z}&6L1xz}bA&|Kx%mmQ26fF24?!uAf>st@!V!?zH6%9Z6IE>|gz{qhHR!
z;*z+2j0W%I?fdsc-tBW^Iez1!>D^DtZc#T3{~cu&+wpL+j_{p1n#yHboZsGPbk41r
z70kUO<1<^}u9<4b9S>zzU#P#&xWd9A<FZTR%@a905BqLhDtq9#&}qpp8gKMO)>|C+
zTC&PJYRN10XN#%@BDO>|-Pxsojl(zc_uX%MTk;j#GgcI<Z~u8u<;XS1gU3F^*x5Z5
z>-0<ca$M%{rcGH=mRwhUESp{|vVgl{Q|^J!vhEX1S|2(TnNOU?c=&zJRQJVO-=xj^
z6!9^3!qq#M7CxGtkuH^RSuL@xDbioKaIyV|ti{3KFV!TxU8(tiD<{LO@t?7q?-Gv8
z&`FDL?^X?d)Y(1%b=CLoh^}*-St))NYZiTocl+M7=w9)LfYZy8_C5P`Z13JDVl1t>
zyL<h=y{?#D@o!S{n(sT0%U1Ake0;kj_vf)Il9~s&h1D1*vVH#h<H@R5>)+&+$Q;Zt
z2=I`5f8y68hCP#%l0PZ!Q1|~Ls<FjMOmD_A$IpKnT%!GC5-a;_pH8V-$DTD|k!)D%
zCL>eR<xX;(?qa5qlaKneY?b*IaP#E0Z5#V!AB9_Qt?Y9DU&{OYT}V)}>`h%$*Tp@T
zYJYjIV(3coF8piv<G0|9ys{mUo(|UAIkmz>&!5yzowjO0+^;EJ4J~?eIXReoSI$q9
zuFUqm<nc8>MPqhZ%jXS}aZ}v=PimUn>pPj%xLI{eW5(|KX~);h*)qSlrmy=>m-38N
z3r!X&Jh^pCQ*LXL?6ohvu8HZ@Dr*-XoN(R1c6)fnhKFiAQ62ZAH+=iNj^R~HWYD=}
zv-jyaHk0`#&3pINf=^%2itAa;?puP9v6`*T>DfW`d}nn6s)J46%73>h_#pVMIQ`lA
z8wa;Gd2HXfd&vdy$Fat$3-Z;sWtA=4^n614kMMh{LE92UGVl0Yxh_Asho5!I`+}uR
z1}iUVx*0BA6Uemx(VWNsnIzAy7X7(H$XtGv+|H^$Yzazp3b(GVimL98ub5>VVraj%
z`)5yB1owgOKWzlV0u}A|Yr9olf3;rl*&_M1GB;IDmHyE^SYYaSoQ31{$LiU0YBTKr
z?W;NSLc%q~BP+*M-D1P+zb#+cLu;H4z1o>AzD_Gka@OSo=WZ$Y@7F%yX=Q7=)vLbw
z*T*IM8@$Y4EzP^SGXJi5XHL7-Ov&wCb-%8@*u-@x<w#6$*t<Z<iwq7w6f34hq@7?g
ztk>}G{BqCI=WN>5d6O?RPe{7=cdJP{ci$@ZzuC`T1opr2{*xmutL8c->yXolCb0{9
z_1dna-){5U{HTNHz_nk&>t6HE-c>IywbSRslfVuyd)fV)f4X!0PIdd#WY=(Nc1Mv)
z`YRsMecv?ZeoIe_brJuQBAMCoIObvLuIE2O<(!u+tqDnMJr(VmrWiMI<%YW#-UQt+
z`ZKTRiRiUd*Er$t3q#b?zU39NaXxwG<aWqnvu&k*QF=z~cExkHmpzZUcUvAjwcz~|
zH_iD?(kzDxvP1n|iB%tEIsPp#R)^)ny6^?rv8_fI`$S)Cn`C%FV49)dWy6U)4RYsg
z#nxRp#vEq9f4Z)x$Hv@CZ})M{Eq*-hnrignm#Z&vnyjlTN$uEQDi-zL$<TY^fj>FA
zqHX;ya$C1OV!XEN$Ab_)<73y4ubc1k^<Sk&qH77yueRV9IY-isN{<D)*<{Og<uOTL
zXbEm}HrcYQh+~5O+U<oR35%r<TuN>371;GGOH@2(fyIq0hy41o-rZYrDD249<^@j{
zc<c;*rG94i#ltdw(+taJPVCEc<L}&7`psB_MRjw*oXMVBw!XYxZrk_EL?ZmX&_ZvU
z<cp^myi)$oH%Q%TEO<D=XZ5|sjJC?R|Afj<bT!Qs*xwbkQC(%zr)e|pU4K*hBg&;z
z?7%HKwto?-92&As-`09LeN3~Nq}r+IozA**=4bZc-TxmPDLvG2JKW-g|D=7n+c@2<
zRhpCkw;G9uWM-=@(G8X7**R^!==+eP2N&$zw2?18?W0r&lML6(J0|v1*)QH&6rWwj
zo5k8?a9HYG%_~0!VVUyRj8l%PvWnbsbvXO^YvIW+ljKgc+TN~8S$;im*}og*M}K>o
zDcgG-KDex1-JR{n?Te1ZRv8~;-1G7;95k6JuxmGi6VIRW$UY+;{kR())BH<PWX|>)
zGB5h2k=g9=_li#W%F`T+D)t<&c+0wS`HVc_5}mARQ`q-x<I#Ec`dhMxsqK{Hwm9}P
zSL0q(9Cf&&FA{n>{#M&ke^HC+S&K9><?n{bxrM*5Gpx?bJd(zBeVS(Klq1JiJ~I2L
zEgU^TwUm8XQHww0(h2)^E4D0BJHj~0URXX>F75ZUkMT#7?ce=u%Z*HAJ6^v|v+2cz
z3&-_8tymVLv8VL1k-*YS*Qi?SG{fcklg!_~KldS7;}&zoywf^8jwdEPD~tbiO<qhf
zNB2uQm*(~(yP4-0<r}Z9DwB3u&s$(#Te$yuV6>D%$_WMs-I<TKMoTnp{yAsQsjbh{
zpL{rfJ)j^uvUY9d($qx@XC8jbVUY3EvtRDBa-~_m+0u6{&knz-Kk~JU^P!L!f9v_f
zRewVBKP>l<XlS(9Rhh56{LS2><!oKnUJI*q7OgJ2z9HA}y5whL)!?_&t!*DqQFcu`
z@FVH0>Bf8Qmn*D3`d81gope)?p||%3LwT*Dt-*n8RSEqq3g@0}+OzartV@%P)a1?Y
z)6(B{7DxEkm~4B$PCqj6;ql&sp|a^aBxcRvw%NaV&0CEVJA#juT-v;GC4an+lEkMA
zj=$%YCo#KCDdt{gAYAU_)FFHQak1e`y=@_^A_@9ZdS(`v*Ec_2*0DqG<D99>Lbw`j
zK7T*CS=fNvUT5YkK@+RTcap4kg?zZ8>YKv)y6`L8qX(_FVow*$dN7-N_2a@B4#Az~
zOL`I}NgG){3~ZPoDd9PJt8XXcz1VrP9fRjgOkeol`tl|lUqh!D-lvmxZm(RaR(ZBw
zp<vUOsH~nBUplucC0%jaapzIu4~uPqKV1#=c+)gQ1quxf%n!4jS!B3cG|T<Wfds>V
z1$RGud@^}8|9aP*ZU=77vHja<x^XG<=H<WkI;>YrS#n5PZuR490W%)gG2ULZpE=B2
zjid9>{{>wf90oD>r!5XnViDf|ZMxHY6Up8$X>T5Gom{rlDZnvvN%ji=TUjjYukYNv
zAyRMi<@$xqPOHK%>$a|~YKXgA_26atp|X;s_?#J>Gd<55%Wc^IZPKop#-~^P+xpXd
z({zJJ5&U{<t~A|QD!{lc@Tl)};Y}(AT5CGKU8t~mEauwvs&Lb^rd&0}*b9=ZZxifx
z<(_AkXWOejRZ;7}j>$U4ZS%9Q1U{RP!M<(JHMMsh`IGcN?r49iyY)~m=TVQ615({K
zKaV|K(!WKazNK4Y>FT3@0^0J*pU*yA+3e}(o4G#m_&4FZCcd0j#~b#Xu3Awn9MvBc
zR`~n#<CD)WZr<N`LT14?RUboc=BJXrm(@JW-w0Mcuz$y_aF>UVBcfX}@Ymv3)AnCz
zVhj0tvo>P=>eAwpYbmww+Y(~p-u;U>@NQNAm-NX+icY&9G!)HqzA?*!$4GTz$jQW~
zT$2j_8!Ff?S;YCkZ$;+R_tV#ATW!)=voD|Z*OXW{`^OJ`o}M`L<c6=A3hVn%8-9HZ
zPLP=9wY*qdI>*qqZ}IE?+?;-o_!De83)!xj-klj4n797*g>4MiUaXyC=Q!=}I&uB~
zQ}b%C2d|6{{v&gGc|)LPV%T>>znN|ZJo2nlwf`PHrgY)i9mmZ^0x4A`-&>M*wd^Wp
ze70eo2!HjTO;_q)zkFL-UUjhL<;?TJ7w^7^e53p^+NrP4_sG0RoAYW7R+djyBd;$0
zn=+X<MRFID3xkDqayGw!u0=vx-Qs1dc0PH-%H<STx_H+|F5#H6x>Y-O-%&Ivd?lyR
zHFePwMoGVEGZyZC@a*~fpDK1y35ne^m!G=#o?knvX6C_@-x(Mf7<fhHlr&82-2sRn
BYtjG!

literal 0
HcmV?d00001

diff --git a/certs/mldsa/mldsa87-ca-cert.pem b/certs/mldsa/mldsa87-ca-cert.pem
new file mode 100644
index 0000000000..56e9a48806
--- /dev/null
+++ b/certs/mldsa/mldsa87-ca-cert.pem
@@ -0,0 +1,161 @@
+-----BEGIN CERTIFICATE-----
+MIIdtDCCC4ugAwIBAgIUb5z4PJr6qzF8bblJgpdmyYcdjDIwCwYJYIZIAWUDBAMT
+MFoxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5hMRAwDgYDVQQHDAdCb3pl
+bWFuMRAwDgYDVQQKDAd3b2xmU1NMMRUwEwYDVQQDDAxNTC1EU0EtODcgQ0EwHhcN
+MjYwNzA5MTk1ODU3WhcNMzYwNzA2MTk1ODU3WjBaMQswCQYDVQQGEwJVUzEQMA4G
+A1UECAwHTW9udGFuYTEQMA4GA1UEBwwHQm96ZW1hbjEQMA4GA1UECgwHd29sZlNT
+TDEVMBMGA1UEAwwMTUwtRFNBLTg3IENBMIIKMjALBglghkgBZQMEAxMDggohADS4
+pq/7fJYXpK0yvXI95Vz7+bpPTJkto4WXqtZ7msVVV5fdHIO/Mnuc6iX9yoH8PGMH
+cvTM6INTpHaeP8rq/GtOvX76QFw8HVH4M0kH1yNiMU/g5mtRIHt0LUZhSqS6B5AW
+ZYygW9ZFwyFru3cvsO3yVEo4H/uwAWqu1zMkOAM4mQpDiO8MJ8K2u9ij5XENU5Ta
+FFHYHsJaVjG5EDlJTw5YJ3UL4ISfQr2nu4zr4ilNlyMWe/52xqbbSov06sO14af8
+U1CSyd8rKBPNod9+4701lC5Qbtrc6wsjIoEmSmQqmaWYAWsWSjg9JJ/RRLZVZDI8
+fOSv36GpFquroaDpc7i6SsBPhY+oNWzLUOwYABowIixLjVsDVbRz+lJ3hgHmFJhr
+wMk9HBi8TvV9uTgE4bwrNzDsWh89mLVuwDcY1VlCg0HWheyvUNZviffkA11IcVCs
+UA8/36x2SUuimv8K+qLDScdgG0I6KLjYlR83Q1VLK7y+iyiKCZ3KWz+91UKLEi48
+u1eZHapCpAMBp9PbaGrPIaC1Cw3Z2nBM7/3R3LpLZyKRDriptRWGPbvPUaZZqMek
+4iA3RDBtlNOpkR0aIwkqU9LMeBu4TPpwJ230rQhoFM69X2WNAmMYH7akd2ElEM1+
+L+Gq/4e9cQlmCxRDruurF3LD2YuZN7By/Lx4j0+8eCtXDzDBoQAK/9p8zVBV4iHZ
+cHqzF+AT47X6NwVmlHU2mOSzDGTpAkHtJdVei20dBfn/kHV0F8qOyHUWJBgL3HDc
+mXI6WxLp+dsBY8GC/MB0q66Sgo69eKH0MhlB4l6a1w1+ILBsfrTBjDZiytQv1dxY
+QMCkot6gMYfTjXhjmZZ6vGrAzve72Hv1ubDS0jeNxlKVMZJBV97CJrcjUiuu1V2m
+lvQ9kCJzOG7tD17nqyYztwoDV0fSt5VoGXA9i3RwRmBr6yF4CN44OcuWElIs/wcR
+/frXeY2LIWqP86ie8EZfHTUfd58jjfbomXBl+XSrUNzBemxxiEUwXVwJPHFBYcri
+KKv2JH/jIQyYIs5YwxIEUWCmWcQGVRbd1TCeOBLaHOBPx4NP5N0N0pfg0krh6yCt
+75JXjmAJ5SgcyrwjfZsYFVr4Sm5ybN1m/YO2uwn6wRs0Rz/1Bpo2+C+xk53fLWmn
+6bosEP3gp8w0EMZtpCRBeeFN2qEIFSNHmHy+NFumCa+dRd6nG4IZSbNxYIPhwMeD
+l5u8qxq/nKj+OzQymAXWSL1Yu8mPOPltwxvXFbqf8pmlA5R/jXytdFltqfjenxPW
+VdDNQDaVPX/wFKX00Q+ztj5R12LL+CIJ+O4+MmkMvm3SaQGoq7n8MmGrVF2et7rd
+SP1G5/Kekr1CXHQUaN1/rbNfha8DbSsULe9Y2iB3eKObHpWlpazlLvjy4lZ1YxzV
+/sOwqcVwDLVyoAzHv1xbfPuRGyXDDfeBXiJtFUapvCgAIVs5uaTDBv+HBx9QBWMn
+mpP+EaTZx2KO1uu1skx5U0NQIttV+R1jnjZT1PdXnBRBwVYOFxRcv4q71j3U3Lja
+XPQdOwKLT/O5lpXo6P83srSZYawBatnrwgCSZKhaAFCbhWKoin3iGhc9la++iIQt
+WhPD177GDaZbT35XCGNrGDYPux0vE0BPWSVXiE8X2b4J0MgwOqPUPG7+peEjq0z2
+bMsxi2dZzpYuDJM6+tMnkht/gzjgqUQmxr1P4t1fH/HJhLun4AzMzgxUh1lHHI5r
+F53DLq5l0eeRjqx12sQJ7fHqG3BAWKkxqZ4Ns1y6/sl26mlvbp+4/O+YdeAJF4YV
+ZplP20f/fw15SoK//iGicBPK7IErcaoeUERGMkalOZq73cGJUI8T9w+Bv6ezhR2v
+4O1oGt3HnnE9zKcItorKnhN7h06oDxGzKVNO5PDzfofB5VRXdF+KWvA0o09Zt2hP
+nSrLZSDYK5BOC3xPbt/dZmYNaj4A1CoQAEXdS5Q7dqsOxfTZy2qfkmJIZYNnIp4a
+rgttOY1d8ZNFSfJTerPfIDeoiDiBJtgcq4RnSYH9TZTXwZcZDoLYe1WyCc7r9BBI
+I7rJnKfkc2ymr9h5iApHOcW098YLt8TVKME7022ITe/tqIXVPW0tuL3EBRoN0DcO
+mXaGKv/7NKxqSfqqyigrxuD2MyHLnaau/JP/7IJVMmqaVidc1mLpmJ6s62sirLVk
+TKR4hubfR3STAQZFqgO0K1x3u6UeY7VU6446xhN/QAUIm2crVqyaYZN6Jsm2gH/b
+bKAFwdoah6jknKZkkiPzQhTobZizeyks6lnUXUhG/Jq0vCnX/x9ewE1P35orqx1q
+DLq8IqSE3+qO4HdWsCRCBbtawW5zMsy/ImV+yxq8fkzoQX4KxOxTCk8aLn5ERvnM
+QYd4b/XAidwBGq6hgz6Qz7Yho+ohsGPmvXbD1sZIaS+PTZq0B59ZWZcEyTcSFeut
+1rDk6RwhXYnyBizrOMyc0X41DkjaA7zsOL/M1zRNQ7MJhAIDuMTbAlUL3f7gh9ta
+850oHoK/f3pU8MLz6Hxx4U3E//w3aVYtLa6So768FxTiINS1bDmJO1KG9CwQr2vn
+mIyEUg5yYLINzN72FqfgFrNdjoR/+nu73VjLST/Af7Nk3/AmeXstqXOoaW5Ic3lB
+RE4nOsPkJsWn1isrECmCjxlvxAgziri8uMEiaI0hBN4kcK19Lk08hUw1IKZMoFhU
+UCb0PRAlhd1mybJxwvbprFfBcDDsl3Wx9SnV9GrwyQWawoDjcjNbv1aplXKHFnxq
+YsOd5FH7O+zwrKsju4NTVawXXRVFgn/a55x8IKpLcKQ4m4RDvqaD5xo5wq4/CRuc
+84ZdmbgXayJhrh4NjgFzaJfLOhQ+A90+0jQwsmsplvyRvCXFxRT1/+UOZ43QzVzz
+ThSGojH3SuFD5QpCigm9JOrVpSXND67e0HkFnTIpUk85AHHe9F6dwCukMh22sH8L
+FuA2b6TeaOEqE9JnhApFrRGqd3CxqlGSrzio01kQeAJOCohhVuXX2l60gikontg+
+nq1ldrpGfr6swDCrfman0VmOm+fwe/CSAfy9uxcadVAa3sFM5g5O8oOyl8Wkhh9X
+uI5x9B2ZFnCJJVkgE7rWfkwK7G6qGLy1g2joWd5p6c+69vdTSmyeIXr/XvDUwsBr
+U2xkquvYIhodKVkSB9t032nBpGGJ3pBX0o5o0Xi6YMYVSXofChvnF0qIKdnOSyCX
+IE8L3eOgEIIvpvESxNmh0yyMM/vtSEjbPZKBbVqBfgw4FKjZF3KUegNwnjj0mkdo
+jNoLEuNlNYqWzj4/Q97GxaLg3nx0H7HIg/ee3Io+qPVvtZRQb9jcJOmwRwVCqyOd
+/VmH9wsBPBsZZoGEA/H4lQ9Gk6LAWJllZF0qvAze4iAthxDdiZmsXUbGFFxV29P2
+6691xE/S+XqS1ZyQycbEiJ3cyozEGT9K3p0z31iaiWMCDEgw6qa095LztXUv06NT
+MFEwHQYDVR0OBBYEFHVFbpeJWj8ipCLfuwtAyA1nJ/ehMB8GA1UdIwQYMBaAFHVF
+bpeJWj8ipCLfuwtAyA1nJ/ehMA8GA1UdEwEB/wQFMAMBAf8wCwYJYIZIAWUDBAMT
+A4ISFADlRw5s/ZzMWs+VwQZJjzrtITgFLUwDflpoaeX+QOSHCShgIOC5ugBrUajT
+hC6+vZmsB3Nw51HfHdEkBu4Y5Adtg54CJKG5LjfBrWU/7YlbXEajvYqxG/FNNwNt
+rC4qYSolWSEfTx6BF7ObfQFcOmgGwlApis2gyqrlxXg5qg/vZ04i/KpqZeDp42Ee
+gK1Tc4LtJVGlpI4tt0nJAtLo4k7sEHoVTgXLHM9zcmf2lW7Kj1LGOPQa4UTWT5vV
+36GikT7v4foSGOyxJioHo8bu0PX5hQDSOjN57HW+iJqVAO+toN9z5uhdi6s+JvGw
+RkzElD/CZpEu++f3412pbW/mUr1mq6KFEeZdmUXPi4pJGE6XVqEybSrtUFaf55u5
+KxXS0+6aQmpm0h/ALkRNBcD2vEiZTUZClqin0Q67R3D4cAg8ou18gwfMoR+hJ03+
+We7CjSSqdWFuzkLp6HFfJv2IWWt8BTs5o5oIsVQFsCWEKXDobCc4NG3ttxPWmWkn
+pYCtDet+buTz6py7aPg7S//R26QfAZ8mg9MxP3IqynCGOUl+qd9opgiNeuZRGXkd
+r7kpoMXYVEx70+BBpfQksL9ZeF345rHWNjkgOWmnuc2E/9WvaRMoT5az+C2Ak4eV
+cIelzDKpf2UZhkSaqfZPPjfibNrQpsALc9qZnPJ1KQcZT9exKJgOtkG11ljQJRQI
+xcKkMDQVVCSKWEdE2r1qeMm6dw3krv6OHSzd9AXAuMuph1BqEVi6TevtGSY5HUzU
+ZEVAbFwF5SFahKq5RlNGgZx85DxUM0dYAHZsxmnnrnXNXfTZ7Kp/bp5RR+4+NAKt
+AzKRe69bIqe6zszlErtmO3kEarcN7ifQG480qnI5L7p+eGvkYJ8UWYHpOaZe0H+l
+if5uDNfgwUNpYoJmsRZHvtH01/phsskyAm/3K7NhGePXuw7tPtYsxE6GY7C8gYdO
+LmRDavCaPKfsjtX6a4K3uqA4YyV0Uzw4I/uUcePY4uymeU8Ce66NxakEOsUmirLF
+Il6TUsDRV/zfpukVTYnltN2ajFilRarXrXxgLb4W60jUV5Q8L8g25LTsvKmW6N0y
+QZ5f4jnuaIfDfBA44GbA+h0RhAK0HwJtjdDWHUX2qOvwf8EaFn+6ol58+zgADtu6
+RGLfKrbeyolnraPU7wvRfDug23zb4uX3hgNeWrjOOv3xXKjyuG7/Z/YHxYRwU8nQ
+m2IRg5aTqUjPkdwMRxHkL/v1AWULHG4MmddL5mQzRYg8J6tEV6obddDWB62XtHWS
+o32ME8zfgZ9zZ82n+J1gOYk+CFqNMMHQBWPaz9QmRQ+bzhV0W5F5hj6V4DzIjXti
+Ya3cchH45YhtgCFKYrQevMOjFVHqUj4VsnYy0qCbZoaTNmOrU4ANFFrhMjs++Jje
+wvEN5DPegS5vmfuK2rK0R67UkPE3o2+xVaPmETcAVTeRUsoLgKJDhhkUMNtW4/uw
+1/WCaRJCIhgrS7liemphhuDouPmIbNzC8zcCWnszrjilA8mkGZmLD92b68+tRpfG
+SfGLJ/oNGslJSgqwtzF1Cy+Ej8EJ1OV4oPhjXAwpYVXTjlDvhI/38sMyfWtYKFny
+S87Ps5qx66Zygnwz+pFfzib5xr4ntBlCQOEpTvBltozvolx1diBhIALj213psm4c
+7LSFl+H49inJGHlZmlF0DPr2R2UiKsKAVamUflwD2+pxIcYS8dbSXtEhuJo6Go2p
+vNd4q7JgObnfaHe7cKYsmhLT7LXB6SCfUehH8X6CqTqTOhspmYQ6iXZmTHeYqu5V
+sxgkcWfpvQyTE3tZLyeLF7yfyyqM0VghAVxr6JyNmXgC8/RGeOQnDETn2Ce+7Utx
+SUxMyYylfValWhmN+EUWIFDWPBFTF0fzGDH3MXMl7ek5rHnnNFV1FiPWtOqm3g4I
+Q19OdOho9XDJ5ahtY37qb+nI0VkNkPMtxIZR2Zyd14ruu6hw91FcujLvCWbi/Qse
+nK+HOLXtdXZKrxB/MShMz4MwetuZ6tgwXMFu9alDrO/qE62FhA/sycOe/jl5vHJk
+Ys9oG8j5DmNHk8ts4sA1gcv6iJm8k8ux54GDjx91MT74bKTYwLTRuORqY5QZb1bv
+9hkS4K0RXglGIy7zltUxSC/Kwsu8pw7pI83VHd5gQC61+lWnF0/XzKIikBUyulhY
+F2XECqvXKE+2/Er3TMfxY7bY8c8J7BHxwfl/E48qWAICQRcfkPMmd/Qc6D91gH/v
+t3v7AmALMAmD1U/JoIwEaU7bRPrDda+VcZZz/fKLZqeAiGKU/L+r8YiPHkA40hcv
+XCgNk7e/vFndjkYEx9jRNd3yI0Za2DH+xQUWuOGTLBPcnCkjdioJ9uwoiZ18mlML
+uGjzBlG6mSbHQcJpe9B/3wGoOEBo00SB2chsucNNsaUdwMcSyxn0KOwuFK84x0qk
+qktapOon5qJ7EFi0WoLcui/WCE1Z+932vYRvIYdoqHMnt/neJMTWQcHG8Fw+PuUW
+iU5k9Mccw7Kyaho5CtT4ppdzFKALeLJtwPMdR5A0heFAcjeRlgHD72yVR6O17Gae
+8ljxXZDV3NKh4ptoZxpg0yZhhoJZTxNxoz/waqNT99J8YO2pKeAKbGg2gf4zRk2k
+CGlVkqPbuyVT4omLn+t694tYis4JamROOKyi8F9G94Ki3nOwUMumYr7m+sa9veQW
+BIVtu41P9ut4m3j+kmOs97nHHXgMCPHtuG35xtQZKcALEyYBkQbz/fjkquqv7G50
+HMFoMFBIHu/I+uIAvJIiY/IiuCdP9BUotEIWLpimQfP8gERbThxheY995ZR6rgdq
+kKIdVmWyMjU1p0IeCUcWNVmTxUyEtRz2UNnJtraxjh3iVzu1eYpH/3UN++5UUmMd
+2S01RaOM0n36SaoAimRLcf0++PsRmG52uFlJQDu3CSpWFc/JK2WWqqBe+pSKgIQu
+nQkIAk2pn2YbeWtN0kj1b2Qom3aE87AZXpRHT8kpNN6OyWqBsyW0gWi7f5bHrJy0
+n3N8jovciiOYqqE0oiDk2topHrViHdb0DUVhZ3skraPBkNcwPbdXaLDhJgxaiN9b
+sPbzrgDqhFlSzmM272dsPJMOkp7u9TgOLxE6CuZ8u9oRWV0phYNna1J/Ds0sUHtT
+Ne0f9zxw8BHuc2fmz9jBtYJIt7G7pNAX410zJaBvJ7Zqdqay55Bn+FfeJVK2YBRp
+3EzU1x+TjA8FlO9wpQIwqdIpRjGlrFECv+Kc4/8CGc2rFfm4Ejcfqh65evwGYCKc
+cbWrelp7i194mjNUMT+ti/mMVlgLwPf5PBFWUSE/vytGetfqrxHmoh+tHNkkynX8
+LcFwNUHHBAjr8XubnH1oP/6+fMzoGEVUSGpsRSc4sJv9hPUHVXxCwuq5axeuKmoZ
+mtPAztojj78rwEk6PTW1Sn+D+vGkv4BKN+qlbtWpb903iWyHOpkZt4p++tXosgrC
+ZMRcU1buURnRAED4IXiWWGbIAjF/KE+J9N45TM1m1Z6T0IOQYt79tTRnC46qB/1r
+5uhRj+xL/GwbHSZFlGrCQsiCFtC9LobUZ9uGTrPiiAzA1vpTrusPm7p/Fxq5TMjk
+UYhKPx2/s/lHCPtlRvKCPoDKm4hyJGfqDBW+9iid9mdmXUQX/GQZaYjjXOF1uuf4
+VR5DpKV8VGaFyltFZiFekamw3dDsUtgy/J6M5BXWZUVeE/ehVCdm9m5xBgnk5kJG
+wjizPXkvcmdoXbchzj3TScZHiznByqDv5EYpn4IbBMJwa1VO6hZ7xQTH9m5dLATQ
+rlega12FMtGOFei2kjHQEJYxTtMxkQyAHs89Fq7UxgNWP7+XLUlIsW3S7b4KnXPj
+ltYlW8Ppq9IJNK56dGWIv3UWWu9CMUuRwPxsLRWGj0QetbbiAda6+OBUDjPG18eu
+n0T1/nlIYUV0DPqGU+hsxGcydcZRRjxrHopuAhvQhFOGQzS0pnIIkC+tt3EUYKMb
+wNJlg40QuuZqFRdsoDjY1MJOjmru3qTCVsTVg6DkoEi5U+onzJvRwxxOljF3mZGO
+aUYPibZ19jMoBCWzcJyTSbS16dd3PY76NBhX7xKhSzxj0coASmT9nzBltTMRw1hM
+q96jAT0j2/xVH5FFNWkQv4pasScksvKWmN7X7HX4WkR1FsDaHgb+WCUIKB2C9q1K
+QvFmPJIliSFLZwW5mfMHU7v/4MR1wojbVzjIT5K+bbYJRjskg2P/hTIXVGlrJKQt
+VR8MuZavFe9UxcGgubKxDmdm8RqIAhwK6dw0P5UH0dqiX2t2DWoFijDDGs586k4A
+Exx36wGUxSUFFNxFQM3z9XHJ9JIeyIU923pkp9dRpv7Yd8X7STYjP0jDwaaHJ0cG
++NvRQXM6aPAcR25v0ME0mRC6uwBCDPx3WY4yDC9e2IiWT3RkHM2NMQOi+ihpg0j9
+1Cx3qcsIoni8x3jtBamnmG4TdCxqlpQHvLYMLObr9mNINT2UY4ZeB8zVXuh4xUDU
+LxRVy1/ahqVPFTiXaqIoaR/dVB5GV+g+MXtuacRmCteWKWWUxMep4jbxKxNbkCV1
+B6ZyhE8BpZC+uyGEoibEAZI/Ex9dHmb7lvFfxWM/7vmGbVlhBsd/rimC6JDQxy/y
+qKZcKLx10zIQpWlFWn07ZjGnL5I37e/O8GMo2gNYnsssjEHIkuZ2X/rWHxYhbC30
+Zwopt8S7A5wybzOtenYbRK8NcDd9cb/nUVsaIGTIAEAtmeO1WxiCs/mcvMq15ifk
+8M/XUHBbWX2teaVloqGZw+0IMGjlSY8e8yN5Nm82pe6E5sPsf8T1ignhEhYPhc/D
+evxVb/CnSBiAgTi6eW8jp+ydxXcGijtKoXosoqty17BtMdcZ8zMlU+2XOz3jlCNF
+ZsD4Ys01sd6H03g68U97mj2S2SEAjY34AHd9IT0wwGslGC+0IM7msrylzl1Egjwa
+k7PvZmfuiXNYT3w0tu+uL1lR4ceNwVUdZ7gYmpgLPL+zrO0oyLhTxnTSs7GpD19M
+Ihjy0EH7nXdiA0aUcwumMBN3TEKIHdfjczHpLrZUBRRgLxouNjjTr4Pjpoi4HvGc
+laZUCoE88/fJsxMwCz8smZoRNDrj3GI7ulTw1CVNZAXrcfUG4uCFPRbloJrgmwur
+43GYQFOJN6SMYJIbMjnhUYCYGRhJk7VNiQHeXZ6bQVOckWeh/zvTsjxNMUJcDeWS
+ubd5qSZ5zX8gcLL0WmqM6PSJtSJi1EK43OJh+Di2UflFMS4NZigVEHExMDfDBsyi
+MasVakfMwGAxUKDd8PHkk6sPr0W5RsDanD39gTWxpQOzp/q9QK8hZKTCGx6r49ZQ
+mON+AduivwNWNyYIicL/oIoICDBc35ajU2IEE7/2l0LvNBmN9Gbs4bWTdrlCUEFp
+pGuoT9pqBK/XubOwWS6z03+hg0KqV9Mtha16gF7deuDpZ8J2dGJfbJgJmUnNMx6w
+v/aSupkzy6r+tfk3spcw4lgPLqzUgtylEAG2UcVNlxOyJDAqrIj20Hg84xZFiupx
+spaCbSYhXdAZBe1gPrptzwcfBr0nlSEqwLiTLDOGn2vUUeaQaAe2vNYm7khvki/x
+uIflLbXCbQnFSHTAGos8+cblpI+0IH+Eixilq8X8UIZud+ebw3mDSU5Naa9hx/YT
+3TRNCTrHgLzLeqhzE1qPWlZx+/PjyebRs7+ByByg9iVMMQsD5RlN0yZJd+wReuA/
+7gMg3QwOCFiLGVH6o+qWv9CCBlT12X1Yr6t1c3TWZH3vhmBcXu7+WMDuqo/0Z5Ny
+IUK74IBynkPYmjgMMiWRVMlh5QqScf8xID2kogngTqhple+XrWs6siysvm8F+pRd
+Rj/j4UzlyMLk2E02JAXv8rD68VNgGJZKp3MXG2wxPY6j649tbI9IX8gGLKEG1jXd
+mVlRbq/r0LYA1uitnD5Blv2uFy//lW5911OpW1P8HMungFEpYVb3MU6ZRjAMHwWV
+K/3FxiLQ5txBszIQZHp094RjuoS6cwHmsK4UD3v8stR/6+ntdXd6wYTpmc9T0d3o
+Wewj8VtCjo5NxJ5ZPM8mgDo55SVZ1aP9ZJMNZBm6AkQAODtjaw8QLThgZn6jpqq5
+5OwFCkJRdaO68QoTXHZ+qrm73CE0ceoeKIqVouQBGU6WmKG74Obn7/kkPlpgYYuZ
+p8re7w8rWnyZwcn3AAAAAA0VHiIoND9H
+-----END CERTIFICATE-----
diff --git a/certs/mldsa/mldsa87-ca-key.pem b/certs/mldsa/mldsa87-ca-key.pem
new file mode 100644
index 0000000000..e9c71950c0
--- /dev/null
+++ b/certs/mldsa/mldsa87-ca-key.pem
@@ -0,0 +1,106 @@
+-----BEGIN PRIVATE KEY-----
+MIITXgIBADALBglghkgBZQMEAxMEghNKMIITRgQgNwwCTHkiSBC/rF+Ih7Ekdxtw
+Xw6CF4GRCESneC+sQ0EEghMgNLimr/t8lhekrTK9cj3lXPv5uk9MmS2jhZeq1nua
+xVXvvrYJ/wP981HQhs2+flwkND3b/pM/uzqsrF2VF8rVQFQS8FLJmeQxZPAJdJHr
+8yh2hRC3FGhmExtAVSF+OHCtBD/gYPvYaBQoH6gDtLATNsRG/KzE74RyA0dUVqNa
+xVBAMCwSJSAYQwQQEQ4ZQGmiEGkBQEiDMDEkEg0SpmkiAQUahUWItggQxzDYojAK
+tgGjRAXCIFEZtWUMsZARCIYCyQiEEowhwwmYFnJUqImaRHFChAASNmyKMG3bAoDk
+RlAElymBSAXJBIjUoInAKEAJSYJcQmgENI0TtkyAqHDDmG3ClJChOGTJmAUJQELg
+EEAZhQzMFg1AAmgCRS7TQIrIJkQgFWgKk40TMgkaNo7MoIUIwSkQRkoElGwjmQ2L
+EGwQlgwRIwHTIgEkiUkIM2IcCGVKpCkQOG0ZAQYThU0LFywcAE2SpmDiNFEQxSWQ
+hgmMEIYURGDKJBLMFmYSIyEioowMtnFMqIQYRSWQpk2ENiAJo00EgW3LECDUEE3I
+knAJEkZZEmCcOHBCIATLSCLQIIQZEE5BwgEJqQUhoGVgkGnJOBGDMJJkIm5aQg7B
+sghJCFHQMIbRAGZBGC4KsojJtkgQuUWBhlHYGGaBBGmRQEoQh2yLCDGEAC5gBHAM
+iWXDRIWQNEUTiGyLBIWYuCSMKGkYoGQkGQ0IQYIcGQYCxknMtE0ahokBw03TxlFZ
+tIhUNiWAgoDjJAaZFjAIOAWSkjEaRYkEAoIZk0UbwJHDEkIAJVLBQEUDMIjQkkCA
+RiCguIlQgCgSkUmTEmqjAEwcA5JhyJFAFmmKMoQcRnIbRnAAMGxMphATgUURqSUh
+sWgZwWyDFA4AAXAZlS0jpHEjo03KIi6kMCnRSAWcki3DgkngEmYMsk0amWFQkGDY
+yIgQwg0Lh4mhQArcMoWJyCQbhoxAlAnMCCkJJwgggmWkQm3YBISjkGDDIE4JJiDb
+lGEZuHFTJAFjFBHSko0iSWpaMExamHHbJIIhw0EUqRHMJDIbwYhBpogEB4yUliQg
+SUZbEHHTgBBkJiLSAoWQCCRLQClEFgTTFgykyGHRKGajNkUToFDENo4iQQALGVKM
+EoDaRmacgEAUyERUOIBEBI6RCDBaFHIUsm3jQCXaGHHcIjHMhAkcyJEjFUyEACbD
+gkGSImjCEEobFCgkkFCMyCwDJFDSIgoiMIwYNGYaNEHQJgVcwCXbFJESSS1jRIkM
+lpEKBmJbEGLhGC0ixixQIkgBKWoAxClCOBKCmG0IlomSxEBMuIVEGEhZFIojNmHD
+EoTAoG1gtoAaswkQwiQMJGBZQmEUsxBKEGojFSWCBDEJkAyjsowIpiTShjFYyCQc
+xEiTIBIgokQJl0xSEkVQNFBEAI0SQAKIBk7YIknSRiFKmBACM2zatg1ZMkkQAw0Y
+Fy1QJm5IRoBJuESDxiQYKZHhJo4USCmAwgiDIG5UqGmTAlHbGETbFErgFIFaRIwL
+kTCTMkyDgCjMuARcoBBcmAWiBIkEMSiSEogKEoqMSFFIOIzZwo2iiIFQQFGCJABD
+OI6JAmSUMALZII6MFgSgElKUIELckCwclygTiFBYhkSDBiWTMIFaogQZBUjhtiiU
+hEHYsIljIo0Mk1HSAiEcwnGRIoYbkSQUNkISIDIEwmkJmEBElmEgxk2bJImhFkYM
+JAQEkFEMAlFkloTIQgoStRAYBjCkNo7jhIXLwJEQMUCbok0MNYrUNm3YwEzgRHDS
+IE4MCS4MN2yRIiKAgG1IqETTIkGTKAAcQmwExCEbxUVgFkETx1GDJJJCFgEaAmVK
+NEDCuExRBIFLKG4JImqCoGUJgGwhFAIRMyxbsGkERmGkpHDUAAYQRA0cEYrEMIoR
+g3HMAmJSJikjhIEENoJBCEzCBGjZMILhmIAMFmUQCZERlEXRKEgCIQUiqVFkxGWY
+EmkSSSHiJELEuIURJwARAIEjBmyARi5KIinhJiwko2ghsEBYJkYCCVDLNooIlQyT
+GBKYIG2RsGAJR0GAQEAJRWSZMG4AIGWhMIRSJkSkokCUMCqDOAWTqEjZBGEgOGJY
+IoHXZHX99Z4b8p4pEdb+5f8CufKCCfHv344dfH0KXiUb9NUOgCsqh9ijL430FxSJ
+Oky6UZWG27+6SzuaOf4IzRyQPAP28pVtQxVtiUZ0iYfWAhQoGBOTDqTim6CgFpVS
+BphdTBwdyuE3gbwbaDgNGVDFSovoHxs6YcoKG3C8ECF29kSgCn6xXKs0FYjxHqwU
+RZFYaGou2mNvhw3UKHDL94hVU7feZVeiQ8dHTI3c0OqlzYj1r2hLPd1J0Fl5Z1+7
+2j2Ahqz0E4zAsZXP5ZZL+b1FCUIbpd+S+6rrZXYuMgHw/sEkIdRpiO41kebdHZR6
+uojohwBnep5+NBiXx5Rk7RybYa6hGZswTdTGIdqJBc/EFDV7LLqOV4i385OPBvtZ
+VRs5ZFFSZMEF0LoGwyiZ9P0Dm15WL43WSMvdR726f4AbSnEPW6NJmOIje9+eyPHD
+dhXkQyw37t3n07io2/DMJIHQR90jE1F7zIrt7cn5JP/H0rvINisswwU0sot/ZyjN
+Ud6wf8fuMqvMM0UO8d9S7B9YRXPUsUwlgWlUTHFugpREMW4AbfNyUC84WUBgXmPg
+qs3KBsJTVG/JNGDXQXmh+0NGF+QMJGnpbS+T0I2PaRNmf3jhW5aEcXj1gSP+QFqg
+kYm8xUa9DH+vyKQaxfEbtkr8CB3QkMcnH4IJfdWaJAFegPRsjJpgrvGBjqK30TEC
+2z8RVsQlCe3wjtDxA7vhKiTR+xTPUCPV1n5/MUxL+FglCQVzmZ3jgUK2K0o0EXr9
+cJXaAK/9cHaKC6yoGTmuVA8aQXhzdR8lsEUDdRIWcJFYSvZs8TyXGeX2BkaJHOeh
+gnxnMZZKrD5djknj0UaE1jYvTem35vhspx/WT+keUwN9KCsu14Lgb3Q40iXWGjFU
+fwc/Lun8BX3ED+Opl0KUibANR2RyncnNUkikBUntB8ZbkqhEuyc/4mnp5WkEdhxw
+43ouco+W+qUo3nPk3ACSX7zmUzfbUPqC8Wq6JXv+gjryd0uf3RbFy+bOw5iT5qO/
+qZ/gZ1AVnzp+yIxvussVLFUhuZcz/x2UpWz1MTvZM+/dDRmeLSrvgqmFgRturSRD
+I+8gisn3d2sSAOLmN1bsYLwr7fqx2PyIKDPj7xskbBIMPYW1z1iutvO/U1qLsHJH
+lWD1gcV3AwE3KrIkS0U/gsYTeAzG3Z2Klrr9XxjKUvAFn9CcdYpFuqvBAx9MsVFQ
+2wUGXH6FM0QdnhxJvqiRGTtzbusC1OKI0vLFLbAe25Ot7plUaeCFoCMgypQmUoJS
+d45XWMdYqtYNjisxQo+yDc92Vo0aR54h58VCbGrQnh2ti/k4CpIf317LreMtajpk
+QT4613jkPzuGvointMj9VD6qgnewYzRrMofAlOiMg608nj45Hst5HlUlTpw6ti/A
+uLXUM6249ldE03OmCy/Mc/opl9S4KP60rRJtl6GNdW7ALgvWAMqtmyJ/b+Pd/Iz5
+ShX8mM+plBrCyGAAPdVNajox4t0jCz+7vMriJoFKH4/yxbcCZd7iNRL+vh1yfDIk
+JV7tqy1IIFjadeEUQeXo/C7tiTsurZvzFTULx1uIplfUN2ZqpIXfSaCgs033Gbig
++oBoZlYDO36TqJa+kvayE+J9Q4MQTHAI1GuQfYsXHxloOpMJE3kse5R9xl+j8DEz
+hwo0HskBPs/CW0UyCLGyDKoiiWXSBQrQOoLr6IqGF1+TKpW/zCJbNoiaZ3C/bDp0
+Rha6wBuE25STLtTrtXxY4bij8Svflun+XzbBIv6B3HFjGIJtQOwiU8HSD88h0Iyb
+7CWSwjFQ04zTrVR0aggzAxpz1HvOmzjfpUhJ5rjWmr18nJ5Ub8wRytqv2SApVZaP
+J1tegrrXXsF/2q3p+WHuowE/5rZWx0Iu1TmC1GnL743i7jzLt/M4HAYhgIlJGA0L
+uHqrxetDuRNE1SB2d6EBL3/aSiFffP1yusMWNt7cZkoXqVKshhcb68ubfUBUrIIN
+FknMCqMhPTSYRN9XV/TTabN+KIw5qC6nwZfsBETlAXv1mHo7I0CBm7S5lLQfjAIg
+4p6JgcwVyePAUeHFAplDmHVqDRZaG9HSnLtabncetlrkAb/7D4QWgbjitN+fZr8R
+I3vKskkmkeAASc4AXFx60yV9weH3VytEgR/uVP8gN4y3WrD33IKQy7MJIi+AJ/g8
+0wF0eKgBoo0lgiHUpV+3E9MRhKAggH5nNFHz2Y9IM3N2B1l0W0pv0vvLcaf+RzPC
+qmt644jTAm+e9DUr7eEzYiMzLO7uaYMpuaISQP+FWrXxEasx33aGbCwc0a40BOVQ
+RHnw91Oyc5LoOs5LOlGEPOX2facM/5se+Xv0d4bopH8lxWSYnpRUq7TOZkBRVmkO
+CAe6CfChLTRGUggWxxZ7mCYRd9cUrrJegdHCgFX0vOEaldVw80lCeKhSVfMp4I3S
+uNUgMCitwkMczgW7GgQaN9vcMPhdXFolnuVIGOJsdZ8IZ/UPrqMjBqNULoOZlHqG
+q7/yCni95yKWl2RBOVJ+iclxZdvf457reS9CZK/cGJvcmphebcKxWsCqqjoeOfB0
+JG+EId16llTscBnUQQCrXTApfZY4DPZkB7f5vhPCFuBG1w5lDB4QcDs68yRSWMCP
+p4KkgBjda3Q2sc9j40qJLHWeHdWvii0mEHnFoUzV1N0nmljmGq4DW/L4JPBc2XfY
+/S1Ii92Hj4JaPZm4OZRE7qLfctdF5JuwUcpRHnrUMxEhfM1tBfT4LXd2qVcwl/W8
+4Wqdc4NaMv5jFjFCL0Wq/27umUek3YMZvlJcV+csXpXDC2cQbLOVa3dm9HLuXA+S
+TyzxlheTlkV7BEO+ZYsf3+rNuc4r04iE7v5Yh8Zx7JHy6HftZmkddOeCPLhi2Fmk
+dINAxldxeIbE2izFcXQgzgWXU4LXRft/5sBNVOUzAmMKDiGhPRtjyPD9OGvXgokO
+2CU+QjfeIqaw0AflVSt2NoQcgesqc3LrEtTRO6C1S3wMCS4LRjwmVIKTT7v8dZ8m
+31IsVgnZNNIrTLOI5WUj9v7nJ24DSs6D6agW/EfdvckdHj0gUv5CDRUck8fYr1Ll
+UB9UD+CbXYkQSiZaOz4ovoIyrjaiLdMZE9XD/Z/Uk5JO2nJ6hNVFdyoZmhVLUwf7
+PPixUkaciCrf4/J/ON6eAKPf6/u+57E/jUN2wOwqoKPtpaXw9lwXkcaEob3Ecr1m
+dJmGFAIuU7Z9OTqgnhF/YBS7e7L162lXBQF20Klk5L2QlKDsRXSiiE1ibJBwM/yF
+MePSpCDKxBbw6KXqnQDkND/APSi2htbbRl8fxpfswQqLJcpvSf1aNa38dP6xxXuA
+UpXNl9/zOs0iK/A94QbF/ao/2ZmqY5KVjdOa0Z9KEtaeSRUczU7gFfr2zzY+Ko41
+/VJEKBZa8rQR9po8zhuT3+fxaKdN4EHAuWZCHxRZdD9THuZzaO3fic7t+/2eg/UU
+dJ3VRGRxpopFU+UHtL96Vh54qckantz9Hfp1kwUnjDbR/t+mE1TAgUvvjvOzZ68U
+gaE8shVb7NNasnKQWvoA844JwrdF1ZF24nFIo5lRl6ACgX5K2O/WUyI8Jx3SRIm5
++gNebOE8KncaWb8E+Nk4y+YMXJpWkbZ1VJNSl1o7mD9GQVQSnRiIyoPz/E0Si/2h
+Pa7N/7h2wJ0Vz67cEYLYHkIeCPaXOcHJVUSsb0WLOpS5oaP3ilHEpvKF96ZF3Ce9
+O2xOXEkVQRF8TNjXGhr7el7Fn79rjQZUlNZKQmj1Aufp3dr0yeeWoObxjbo/mB1V
+PyKimQumf/RZoTBNJqM6fdiHJlobQJ6FgjoacuGoV2Q5Tdfb7CXF0rjfd15YZR5M
+EumOha8fQETdcyZ0U29MWXC9z/WmkG/Fh0LqFyCSe84P7lhZ1noHDBb6MYfCkd19
+o32julo2Rl9utdz3EVKmUDxY3Tw7fFzQHVlg5vZWv8FeXPm/jnhmnSVftDOcRLCL
+eTQP/AEl1EuTtL7Nhjabk/3MEjTgi7I1zMHYv42Vg74fn6IPtUWGHWC77hTevoyI
+TZnS2cQXt11ILdYDXmR8lpBRlcGU3bLB1XxTPMHmFE2IkgxIuwjvPpiqF+nqaayV
+g2ZZgb6/djNnOMSspy4V6bNhJ1fSRamxIYIi9y395/93fmTBJt07+Bix4PlKtCGA
+NYfnFAhPg8YW2AFaw+H+tdnXuCfdwjtDc1G8+WWYS+SoHyOsCLNUa6wkd7Qsp5Cv
+KIwT7Vkw/hQFzqf72Y3/i4BY/EXjEGKfruaZozpDkepovVzKTgh86JKrioFbG+Q1
+7CP6KIYBC3G0qwQXjZAzVNUcDp2GchcCvr7xSNWCeOgzZbHSFDmzxZ03Fo30Txpu
+8ZnaRcEuLpZ60FKgkiO4rXOyVqbSXpcIDlsocNz12Qx4tv41ZHfHbJ4Iv2mGSGpQ
+jKttRdfzaXJpYSd9sPAb2phr
+-----END PRIVATE KEY-----
diff --git a/certs/renewcerts.sh b/certs/renewcerts.sh
index e0dc5bd010..50499babad 100755
--- a/certs/renewcerts.sh
+++ b/certs/renewcerts.sh
@@ -1287,6 +1287,45 @@ EOF
 
         rm -f mldsa/ecc-leaf-mldsa44.csr mldsa/ecc-leaf.ext mldsa/mldsa44-cert.srl
         echo "End of ecc-leaf-mldsa44 section"
+
+        # Cross-level chain (ML-DSA-65 leaf signed by an ML-DSA-87 CA); tests
+        # that verification uses the verifying key's own ML-DSA level, not
+        # the leaf's.
+        echo "Generating mldsa87-ca / mldsa65-leaf87ca cross-level chain..."
+
+        "$OPENSSL3" genpkey -algorithm ML-DSA-87 -out mldsa/mldsa87-ca-key.pem
+        check_result $? "mldsa87-ca key generation"
+
+        "$OPENSSL3" req -x509 -new -key mldsa/mldsa87-ca-key.pem -days 3650 \
+            -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-87 CA" \
+            -out mldsa/mldsa87-ca-cert.pem
+        check_result $? "mldsa87-ca certificate generation"
+
+        "$OPENSSL3" genpkey -algorithm ML-DSA-65 \
+            -out mldsa/mldsa65-leaf87ca-key.pem
+        check_result $? "mldsa65-leaf87ca key generation"
+
+        "$OPENSSL3" req -new -key mldsa/mldsa65-leaf87ca-key.pem \
+            -subj "/C=US/ST=Montana/L=Bozeman/O=wolfSSL/CN=ML-DSA-65 leaf signed by ML-DSA-87" \
+            -out mldsa/leaf87ca.csr
+        check_result $? "mldsa65-leaf87ca request"
+
+        "$OPENSSL3" x509 -req -in mldsa/leaf87ca.csr \
+            -CA mldsa/mldsa87-ca-cert.pem -CAkey mldsa/mldsa87-ca-key.pem \
+            -CAcreateserial -days 3650 \
+            -out mldsa/mldsa65-leaf87ca-cert.pem
+        check_result $? "mldsa65-leaf87ca certificate generation"
+
+        "$OPENSSL3" x509 -in mldsa/mldsa87-ca-cert.pem -outform DER \
+            -out mldsa/mldsa87-ca-cert.der
+        check_result $? "mldsa87-ca DER conversion"
+
+        "$OPENSSL3" x509 -in mldsa/mldsa65-leaf87ca-cert.pem -outform DER \
+            -out mldsa/mldsa65-leaf87ca-cert.der
+        check_result $? "mldsa65-leaf87ca DER conversion"
+
+        rm -f mldsa/leaf87ca.csr mldsa/mldsa87-ca-cert.srl
+        echo "End of cross-level chain section"
         echo "---------------------------------------------------------------------"
     else
         echo "Skipping ML-DSA cert generation (no OpenSSL 3.5+ built-in ML-DSA provider found)"
diff --git a/src/ssl.c b/src/ssl.c
index f5a309552c..9db76d18a1 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -6911,7 +6911,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
 #ifdef WOLFSSL_HAVE_ERROR_QUEUE
         return (unsigned long)wc_GetErrorNodeErr();
 #else
-        return (unsigned long)(0 - NOT_COMPILED_IN);
+        return 0;
 #endif
     }
 #endif
@@ -12400,7 +12400,7 @@ unsigned long wolfSSL_ERR_peek_last_error_line(const char **file, int *line)
         return (unsigned long)ret;
     }
 #else
-    return (unsigned long)(0 - NOT_COMPILED_IN);
+    return 0;
 #endif
 }
 
@@ -13374,7 +13374,7 @@ unsigned long wolfSSL_ERR_peek_last_error(void)
         return (unsigned long)ret;
     }
 #else
-    return (unsigned long)(0 - NOT_COMPILED_IN);
+    return 0;
 #endif
 }
 
diff --git a/src/x509.c b/src/x509.c
index 2df1f793dc..3842b2feb6 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -6430,8 +6430,15 @@ WOLFSSL_EVP_PKEY* wolfSSL_X509_get_pubkey(WOLFSSL_X509* x509)
         #ifdef WOLFSSL_HAVE_MLDSA
             else if (x509->pubKeyOID == ML_DSA_44k ||
                      x509->pubKeyOID == ML_DSA_65k ||
-                     x509->pubKeyOID == ML_DSA_87k) {
+                     x509->pubKeyOID == ML_DSA_87k
+        #ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
+                     || x509->pubKeyOID == DILITHIUM_LEVEL2k ||
+                     x509->pubKeyOID == DILITHIUM_LEVEL3k ||
+                     x509->pubKeyOID == DILITHIUM_LEVEL5k
+        #endif
+                     ) {
                 key->type = WC_EVP_PKEY_DILITHIUM;
+                WOLFSSL_ATOMIC_STORE(key->mldsaOID, x509->pubKeyOID);
             }
         #endif
             else {
@@ -8988,6 +8995,16 @@ static int verifyX509orX509REQ(WOLFSSL_X509* x509, WOLFSSL_EVP_PKEY* pkey,
             type = DSAk;
             break;
 
+    #if defined(WOLFSSL_HAVE_MLDSA)
+        case WC_EVP_PKEY_DILITHIUM:
+            type = WOLFSSL_ATOMIC_LOAD(pkey->mldsaOID);
+            if (type == 0) {
+                WOLFSSL_MSG("ML-DSA pkey missing key OID");
+                return WOLFSSL_FATAL_ERROR;
+            }
+            break;
+    #endif
+
         default:
             WOLFSSL_MSG("Unknown pkey key type");
             return WOLFSSL_FATAL_ERROR;
diff --git a/tests/api/test_mldsa.c b/tests/api/test_mldsa.c
index 5a91f220c3..798cedf529 100644
--- a/tests/api/test_mldsa.c
+++ b/tests/api/test_mldsa.c
@@ -3056,13 +3056,8 @@ int test_mldsa_der(void)
     /* When security level is not set, we attempt to parse it from DER. Since
      * the supplied DER is invalid, this should fail with ASN parsing error */
     idx = 0;
-#ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
-    ExpectIntEQ(wc_MlDsaKey_PublicKeyDecode(key, der, pubDerLen, &idx),
-                WC_NO_ERR_TRACE(BAD_FUNC_ARG));
-#else
     ExpectIntEQ(wc_MlDsaKey_PublicKeyDecode(key, der, pubDerLen, &idx),
                 WC_NO_ERR_TRACE(ASN_PARSE_E));
-#endif
     idx = 0;
 #ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
     ExpectIntEQ(wc_MlDsaKey_PrivateKeyDecode(key, der, privDerLen, &idx),
diff --git a/tests/api/test_ossl_x509_crypto.c b/tests/api/test_ossl_x509_crypto.c
index 2199e3e4ec..ddc5b83f13 100644
--- a/tests/api/test_ossl_x509_crypto.c
+++ b/tests/api/test_ossl_x509_crypto.c
@@ -82,6 +82,7 @@ int test_wolfSSL_X509_check_private_key_mldsa(void)
     !defined(NO_BIO) && !defined(NO_CHECK_PRIVATE_KEY) && \
     defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_SIGN) && \
     !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
+    !defined(WOLFSSL_MLDSA_NO_ASN1) && \
     (defined(OPENSSL_ALL) || defined(WOLFSSL_WPAS_SMALL)) && \
     (!defined(WOLFSSL_NO_ML_DSA_44) || !defined(WOLFSSL_NO_ML_DSA_65) || \
      !defined(WOLFSSL_NO_ML_DSA_87))
@@ -253,6 +254,109 @@ int test_wolfSSL_X509_verify(void)
     return EXPECT_RESULT();
 }
 
+/* Verify must use the verifying key's own ML-DSA level, not the leaf's. */
+int test_wolfSSL_X509_verify_mldsa_cross_level(void)
+{
+    EXPECT_DECLS;
+#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && \
+    defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
+    !defined(WOLFSSL_MLDSA_NO_ASN1) && \
+    !defined(WOLFSSL_NO_ML_DSA_44) && !defined(WOLFSSL_NO_ML_DSA_65) && \
+    !defined(WOLFSSL_NO_ML_DSA_87)
+    WOLFSSL_X509* ca = NULL;
+    WOLFSSL_X509* leaf = NULL;
+    WOLFSSL_X509* wrongLevelCert = NULL;
+    WOLFSSL_EVP_PKEY* caPubKey = NULL;
+    WOLFSSL_EVP_PKEY* d2iPubKey = NULL;
+    WOLFSSL_EVP_PKEY* wrongLevelPubKey = NULL;
+    unsigned char buf[4096];
+    const unsigned char* pt = NULL;
+    int bufSz;
+
+    ExpectNotNull(ca = wolfSSL_X509_load_certificate_file(
+        "./certs/mldsa/mldsa87-ca-cert.der", WOLFSSL_FILETYPE_ASN1));
+    ExpectNotNull(leaf = wolfSSL_X509_load_certificate_file(
+        "./certs/mldsa/mldsa65-leaf87ca-cert.der", WOLFSSL_FILETYPE_ASN1));
+
+    ExpectNotNull(caPubKey = wolfSSL_X509_get_pubkey(ca));
+    ExpectIntEQ(wolfSSL_X509_verify(leaf, caPubKey), WOLFSSL_SUCCESS);
+
+    /* Same key via d2i_PUBKEY (raw SPKI, no cert). */
+    bufSz = (int)sizeof(buf);
+    ExpectIntEQ(wolfSSL_X509_get_pubkey_buffer(ca, buf, &bufSz),
+        WOLFSSL_SUCCESS);
+    pt = buf;
+    ExpectNotNull(d2iPubKey = wolfSSL_d2i_PUBKEY(NULL, &pt, bufSz));
+    ExpectIntEQ(wolfSSL_X509_verify(leaf, d2iPubKey), WOLFSSL_SUCCESS);
+
+    /* Wrong-level key must fail. */
+    ExpectNotNull(wrongLevelCert = wolfSSL_X509_load_certificate_file(
+        "./certs/mldsa/mldsa44-cert.der", WOLFSSL_FILETYPE_ASN1));
+    ExpectNotNull(wrongLevelPubKey = wolfSSL_X509_get_pubkey(wrongLevelCert));
+    ExpectIntEQ(wolfSSL_X509_verify(leaf, wrongLevelPubKey),
+        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
+
+    wolfSSL_EVP_PKEY_free(caPubKey);
+    wolfSSL_EVP_PKEY_free(d2iPubKey);
+    wolfSSL_EVP_PKEY_free(wrongLevelPubKey);
+    wolfSSL_FreeX509(ca);
+    wolfSSL_FreeX509(leaf);
+    wolfSSL_FreeX509(wrongLevelCert);
+#endif
+    return EXPECT_RESULT();
+}
+
+/* EVP_PKCS82PKEY() decodes the DER itself (via d2iTryMlDsaKey()), which
+ * already knows the OID from that decode and stashes it on the pkey, so
+ * wolfSSL_X509_verify() has what it needs even though this pkey was never
+ * loaded from a cert. */
+int test_wolfSSL_X509_verify_mldsa_privkey_pkey(void)
+{
+    EXPECT_DECLS;
+#if defined(OPENSSL_EXTRA) && !defined(NO_FILESYSTEM) && !defined(NO_BIO) && \
+    defined(HAVE_DILITHIUM) && !defined(WOLFSSL_DILITHIUM_NO_SIGN) && \
+    !defined(WOLFSSL_DILITHIUM_NO_VERIFY) && \
+    defined(WOLFSSL_MLDSA_PRIVATE_KEY) && !defined(WOLFSSL_MLDSA_NO_ASN1) && \
+    (defined(OPENSSL_ALL) || defined(WOLFSSL_WPAS_SMALL)) && \
+    !defined(WOLFSSL_NO_ML_DSA_44)
+    PKCS8_PRIV_KEY_INFO* pt = NULL;
+    EVP_PKEY* pkey = NULL;
+    X509* x509 = NULL;
+    BIO* bio = NULL;
+    byte* buf = NULL;
+    size_t sz = 0;
+
+    ExpectIntEQ(load_file("./certs/mldsa/mldsa44-key.pem", &buf, &sz), 0);
+    ExpectNotNull(bio = BIO_new_mem_buf((void*)buf, (int)sz));
+    ExpectNotNull(pt = d2i_PKCS8_PRIV_KEY_INFO_bio(bio, NULL));
+    ExpectNotNull(pkey = EVP_PKCS82PKEY(pt));
+    if (pkey != NULL) {
+        /* Not loaded from a cert, but d2iTryMlDsaKey() already decoded the
+         * DER once to build this pkey, so it stashes the OID it already
+         * knows instead of leaving it to be rediscovered later. */
+        ExpectIntEQ(WOLFSSL_ATOMIC_LOAD(pkey->mldsaOID), ML_DSA_44k);
+        ExpectNotNull(pkey->pkey.ptr);
+        ExpectIntGT(pkey->pkey_sz, 0);
+    }
+
+    ExpectNotNull(x509 = X509_load_certificate_file(
+        "./certs/mldsa/mldsa44-cert.der", SSL_FILETYPE_ASN1));
+
+    /* Fails the actual signature check (this is a private key, not the
+     * cert's public key), but must not hit the "missing key OID"
+     * FATAL_ERROR path. */
+    ExpectIntEQ(wolfSSL_X509_verify(x509, pkey),
+        WC_NO_ERR_TRACE(WOLFSSL_FAILURE));
+
+    X509_free(x509);
+    EVP_PKEY_free(pkey);
+    PKCS8_PRIV_KEY_INFO_free(pt);
+    BIO_free(bio);
+    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+#endif
+    return EXPECT_RESULT();
+}
+
 int test_wolfSSL_X509_sign(void)
 {
     EXPECT_DECLS;
diff --git a/tests/api/test_ossl_x509_crypto.h b/tests/api/test_ossl_x509_crypto.h
index cf40bca9a3..68ce053d6b 100644
--- a/tests/api/test_ossl_x509_crypto.h
+++ b/tests/api/test_ossl_x509_crypto.h
@@ -27,6 +27,8 @@
 int test_wolfSSL_X509_check_private_key(void);
 int test_wolfSSL_X509_check_private_key_mldsa(void);
 int test_wolfSSL_X509_verify(void);
+int test_wolfSSL_X509_verify_mldsa_cross_level(void);
+int test_wolfSSL_X509_verify_mldsa_privkey_pkey(void);
 int test_wolfSSL_X509_sign(void);
 int test_wolfSSL_X509_sign2(void);
 int test_wolfSSL_make_cert(void);
@@ -36,6 +38,10 @@ int test_wolfSSL_make_cert(void);
     TEST_DECL_GROUP("ossl_x509_crypto",                                        \
         test_wolfSSL_X509_check_private_key_mldsa),                            \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_X509_verify),             \
+    TEST_DECL_GROUP("ossl_x509_crypto",                                        \
+        test_wolfSSL_X509_verify_mldsa_cross_level),                           \
+    TEST_DECL_GROUP("ossl_x509_crypto",                                        \
+        test_wolfSSL_X509_verify_mldsa_privkey_pkey),                          \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_X509_sign),               \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_X509_sign2),              \
     TEST_DECL_GROUP("ossl_x509_crypto", test_wolfSSL_make_cert)
diff --git a/wolfcrypt/src/evp_pk.c b/wolfcrypt/src/evp_pk.c
index e4ae5f918b..73b9ddc3f6 100644
--- a/wolfcrypt/src/evp_pk.c
+++ b/wolfcrypt/src/evp_pk.c
@@ -1001,6 +1001,8 @@ static int d2iTryMlDsaKey(WOLFSSL_EVP_PKEY** out, const unsigned char* mem,
     word32 keyIdx = 0;
     int isMlDsa = 0;
     int i, numLevels, rc;
+    int oidSum = 0;
+    int ret;
     WC_DECLARE_VAR(mldsa, wc_MlDsaKey, 1, NULL);
 
 #if !defined(WOLFSSL_MLDSA_PRIVATE_KEY)
@@ -1064,6 +1066,16 @@ static int d2iTryMlDsaKey(WOLFSSL_EVP_PKEY** out, const unsigned char* mem,
         }
     }
 
+    if (isMlDsa) {
+        /* Level is already known from the successful import/decode above -
+         * grab the OID now so callers don't need to re-decode the key
+         * later just to recover it (e.g. wolfSSL_X509_verify()). */
+        int keyFormat = 0;
+        if (mldsa_get_oid_sum(mldsa, &keyFormat) == 0) {
+            oidSum = keyFormat;
+        }
+    }
+
     wc_MlDsaKey_Free(mldsa);
     WC_FREE_VAR_EX(mldsa, NULL, DYNAMIC_TYPE_MLDSA);
 
@@ -1072,7 +1084,11 @@ static int d2iTryMlDsaKey(WOLFSSL_EVP_PKEY** out, const unsigned char* mem,
     }
 
     /* Copy the consumed DER into pkey->pkey.ptr when the input was DER */
-    return d2i_make_pkey(out, mem, keyIdx, priv, WC_EVP_PKEY_DILITHIUM);
+    ret = d2i_make_pkey(out, mem, keyIdx, priv, WC_EVP_PKEY_DILITHIUM);
+    if ((ret == 1) && (out != NULL) && (*out != NULL) && (oidSum != 0)) {
+        WOLFSSL_ATOMIC_STORE((*out)->mldsaOID, oidSum);
+    }
+    return ret;
 }
 #endif /* WOLFSSL_HAVE_MLDSA */
 
diff --git a/wolfcrypt/src/logging.c b/wolfcrypt/src/logging.c
index a6d2786820..436d3df266 100644
--- a/wolfcrypt/src/logging.c
+++ b/wolfcrypt/src/logging.c
@@ -1680,6 +1680,8 @@ int wc_ERR_remove_state(void)
     return 0;
 }
 
+/* Returns 0 both when the error queue is empty and when
+ * WOLFSSL_HAVE_ERROR_QUEUE is not compiled in. */
 unsigned long wc_PeekErrorNodeLineData(const char **file, int *line,
                                        const char **data, int *flags,
                                        int (*ignore_err)(int err))
@@ -1695,13 +1697,15 @@ unsigned long wc_PeekErrorNodeLineData(const char **file, int *line,
     if (flags != NULL) {
         *flags = 0;
     }
-    return (unsigned long)(0 - NOT_COMPILED_IN);
+    return 0;
 }
 
+/* Returns 0 both when the error queue is empty and when
+ * WOLFSSL_HAVE_ERROR_QUEUE is not compiled in. */
 int wc_GetErrorNodeErr(void)
 {
     WOLFSSL_ENTER("wc_GetErrorNodeErr");
-    return (0 - NOT_COMPILED_IN);
+    return 0;
 }
 
 #if !defined(NO_FILESYSTEM) && !defined(NO_STDIO_FILESYSTEM)
diff --git a/wolfcrypt/src/wc_mldsa.c b/wolfcrypt/src/wc_mldsa.c
index b564167111..addac864f2 100644
--- a/wolfcrypt/src/wc_mldsa.c
+++ b/wolfcrypt/src/wc_mldsa.c
@@ -12066,32 +12066,8 @@ int wc_MlDsaKey_ExportKey(wc_MlDsaKey* key, byte* priv, word32 *privSz,
 
 #endif /* WOLFSSL_MLDSA_PRIVATE_KEY */
 
-#ifndef WOLFSSL_MLDSA_NO_ASN1
-
-/* Maps ASN.1 OID to wolfCrypt security level macros */
-static int mapOidToSecLevel(int oid)
-{
-    switch (oid) {
-        case ML_DSA_44k:
-            return WC_ML_DSA_44;
-        case ML_DSA_65k:
-            return WC_ML_DSA_65;
-        case ML_DSA_87k:
-            return WC_ML_DSA_87;
-#ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
-        case DILITHIUM_LEVEL2k:
-            return WC_ML_DSA_44_DRAFT;
-        case DILITHIUM_LEVEL3k:
-            return WC_ML_DSA_65_DRAFT;
-        case DILITHIUM_LEVEL5k:
-            return WC_ML_DSA_87_DRAFT;
-#endif
-        default:
-            return ASN_UNKNOWN_OID_E;
-    }
-}
-
-/* Get OID sum from ML-DSA key */
+/* Get OID sum from ML-DSA key. No ASN.1 dependency, so available regardless
+ * of WOLFSSL_MLDSA_NO_ASN1. */
 int mldsa_get_oid_sum(wc_MlDsaKey* key, int* keyFormat) {
     int ret = 0;
 
@@ -12127,6 +12103,31 @@ int mldsa_get_oid_sum(wc_MlDsaKey* key, int* keyFormat) {
     return ret;
 }
 
+#ifndef WOLFSSL_MLDSA_NO_ASN1
+
+/* Maps ASN.1 OID to wolfCrypt security level macros */
+static int mapOidToSecLevel(int oid)
+{
+    switch (oid) {
+        case ML_DSA_44k:
+            return WC_ML_DSA_44;
+        case ML_DSA_65k:
+            return WC_ML_DSA_65;
+        case ML_DSA_87k:
+            return WC_ML_DSA_87;
+#ifdef WOLFSSL_MLDSA_FIPS204_DRAFT
+        case DILITHIUM_LEVEL2k:
+            return WC_ML_DSA_44_DRAFT;
+        case DILITHIUM_LEVEL3k:
+            return WC_ML_DSA_65_DRAFT;
+        case DILITHIUM_LEVEL5k:
+            return WC_ML_DSA_87_DRAFT;
+#endif
+        default:
+            return ASN_UNKNOWN_OID_E;
+    }
+}
+
 #if defined(WOLFSSL_MLDSA_PRIVATE_KEY)
 
 /* Decode the DER encoded ML-DSA key.
@@ -12514,13 +12515,10 @@ static int mldsa_oid_to_level(const byte* oid, word32 oidLen, byte* level)
  *                            input, the level will be detected from the DER
  *                            file based on the algorithm OID, appropriately
  *                            decoded, then updated in the key structure on
- *                            output. Auto-detection is not supported for
- *                            FIPS 204 draft mode unless WOLFSSL_MLDSA_NO_ASN1
- *                            is also defined.
+ *                            output.
  * @param [in]      inSz      Total size of data in array.
  * @return  0 on success.
  * @return  BAD_FUNC_ARG when input, inOutIdx or key is NULL or inSz is 0.
- * @return  BAD_FUNC_ARG when level not set and auto-detection unsupported.
  * @return  Other negative on parse error.
  */
 int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
@@ -12554,8 +12552,13 @@ int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
 
     #if !defined(WOLFSSL_MLDSA_NO_ASN1)
             /* Get OID sum for level. */
+            if (key->level == 0) { /* Check first, because key->params will
+                                   * be NULL when key->level = 0 */
+                /* Level not set by caller, decode from DER */
+                keyType = ANONk; /* 0, not a valid key type in this situation*/
+            }
         #if defined(WOLFSSL_MLDSA_FIPS204_DRAFT)
-            if (key->params == NULL) {
+            else if (key->params == NULL) {
                 ret = BAD_FUNC_ARG;
             }
             else if (key->params->level == WC_ML_DSA_44_DRAFT) {
@@ -12567,9 +12570,8 @@ int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
             else if (key->params->level == WC_ML_DSA_87_DRAFT) {
                 keyType = DILITHIUM_LEVEL5k;
             }
-            else
         #endif
-            if (key->level == WC_ML_DSA_44) {
+            else if (key->level == WC_ML_DSA_44) {
                 keyType = ML_DSA_44k;
             }
             else if (key->level == WC_ML_DSA_65) {
@@ -12579,8 +12581,7 @@ int wc_MlDsaKey_PublicKeyDecode(wc_MlDsaKey* key, const byte* input,
                 keyType = ML_DSA_87k;
             }
             else {
-                /* Level not set by caller, decode from DER */
-                keyType = ANONk; /* 0, not a valid key type in this situation*/
+                ret = BAD_FUNC_ARG;
             }
             if (ret == 0) {
                 /* Decode the asymmetric key and get out public key data. */
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index b5a0fb4a07..12e2917839 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -632,6 +632,9 @@ struct WOLFSSL_EVP_PKEY {
 #endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
 #ifdef HAVE_ECC
     int pkey_curve;
+#endif
+#ifdef WOLFSSL_HAVE_MLDSA
+    wolfSSL_Atomic_Int mldsaOID;
 #endif
     word16 pkcs8HeaderSz;
 
diff --git a/wolfssl/wolfcrypt/wc_mldsa.h b/wolfssl/wolfcrypt/wc_mldsa.h
index 12384878e4..775f12f375 100644
--- a/wolfssl/wolfcrypt/wc_mldsa.h
+++ b/wolfssl/wolfcrypt/wc_mldsa.h
@@ -830,9 +830,7 @@ int wc_MlDsaKey_ExportKey(wc_MlDsaKey* key, byte* priv, word32 *privSz,
     byte* pub, word32 *pubSz);
 #endif
 
-#ifndef WOLFSSL_MLDSA_NO_ASN1
 WOLFSSL_LOCAL int mldsa_get_oid_sum(wc_MlDsaKey* key, int* keyFormat);
-#endif /* WOLFSSL_MLDSA_NO_ASN1 */
 
 #ifndef WOLFSSL_MLDSA_NO_ASN1
 #if defined(WOLFSSL_MLDSA_PRIVATE_KEY)