Verifier-side keyring load + validation.

config :raxol_agent_client_protocol,
  attach_keyring: %{
    "k1" => {:hex, "<64 hex chars>"},        # 32-byte Ed25519 public key
    "k2" => {:file, "/etc/raxol/k2.pub"},    # raw-32-bytes or hex file
    "k3" => {:raw, <<...32 bytes...>>}
  }

Validated on every load: load/0 runs on each attach that carries a token, and every value must normalize to exactly 32 bytes or it raises. Under AttachPolicy.Runner that raise denies the attach as {:denied, :policy_crash} and logs the error; nothing is checked at boot.

HARD RULE: the keyring comes from the VERIFIER's own configuration ONLY. It is NEVER read from inside an attached artifact — a keyring.json shipped in a tar'd session dir is untrusted data; loading it would let whoever produced the tar mint their own admission. Rotation is grow-only: ADD a kid to rotate; REMOVE a kid to revoke every token under it.