Summary

Allow users to supply a crypto.Signer implementation instead of an actual private key to dtls.v2.Config.

This would allow an abstration allowing customers to use keys embedded into hardware (TPM) or KMS systems that implement that interface.

Motivation

Right now users have to supply the raw private key to Config but with TPM, KMS or PKCS-11 systems, the key is not extractactable but is 'available' for use sometimes through a a crypto.signer interface:

eg for TPM

• go-tpm-tools
• salrashid123/signer - example

with this feature, a client on a device can use its embedded key for dtls connections

Additional context

some additional refernces (untested at scale)

• JWT:

  • https://github.com/salrashid123/golang-jwt-signer
  • https://github.com/salrashid123/golang-jwt-pkcs11

• mTLS

  • https://github.com/salrashid123/go_tpm_https_embed
  • https://github.com/salrashid123/mtls_pkcs11