EC keygen now returns proper SPKI DER instead of raw point bytes. RSA keygen uses caller-supplied exponent via new_with_exp() and validates key size to 2048/3072/4096. Keybox parser extracts leaf subject DN (not issuer). Added AttestKey=7 to KeyPurpose. Realigned error variants with spec.