v0.1.4 — Ed25519 + xref-stream

Two more items off the roadmap.

Ed25519 signing keys (RFC 8419)

The signer key may now be Ed25519 (in addition to RSA and ECDSA), detected automatically from the keystore. An adapter gives ed25519-dalek the SignatureBitStringEncoding the CMS/X.509 builders need; signing uses SHA-512 for the message digest; the verifier validates Ed25519 SignerInfo signatures and Ed25519 certificate chains.

Note: most PDF readers (e.g. Adobe) do not validate Ed25519 PDF signatures yet — this crate's own verifier does.

Cross-reference stream incremental updates

Incremental updates now match the source: if the original PDF's last cross-reference is a stream (PDF 1.5+), the update is emitted as a /Type /XRef stream (FlateDecode, W=[1 4 2], self-indexing, chained via /Prev); otherwise the traditional table is used. Auto-detected — no configuration.

Verified end to end: an xref-stream PDF (generated by qpdf) signs to an xref-stream incremental update that Poppler pdfsig validates, with the original bytes preserved byte-for-byte.

Remaining: full policy-tree processing (deliberately out of scope) and richer visible appearances.