"Generating Ed25519 keys" example gives invalid openssl command

[Skyb0rg007]

Specify which documentation you found a problem with

Under the documentation for the new --httpsig-key option, there is the following paragraph:

Generating Ed25519 keys
               With OpenSSL 3:

               openssl genpkey -algorithm ED25519 -out k.pem
               openssl pkey -in k.pem -outform RAW -out k.raw
               xxd -p -c 64 k.raw | tr -d '\n' > k.hex

               Use "@k.hex" with "--httpsig-key".

The problem

openssl pkey does not support the option -outform RAW:

$ openssl --version
OpenSSL 3.6.4 25 Aug 2026 (Library: OpenSSL 3.6.4 25 Aug 2026)
$ openssl pkey -in key.pem -outform RAW -out k.raw
pkey: Bad format "RAW"
pkey: Invalid format "RAW" for option -outform
pkey: Use -help for summary.

[bagder]

Hm, it should probably be DER rather than RAW I suspect?

[Skyb0rg007]

Hm, it should probably be DER rather than RAW I suspect?

That still doesn't work, since the xxd command will then print the hex encoding for the entire ASN.1 message, not just the private key.

[bagder]

Then I propose we just drop the example

[Skyb0rg007]

I think we can actually make DER work, since it’s just a header. Ie. -outform DER -out k.der, then tail -c 32 < k.der | xxd ….

Then I propose we just drop the example

I do think having an example is useful especially for the experimental features like HTTP signatures to encourage testing.