feat: Add key fingerprinting for backup archives

Fingerprint hashes the raw key bytes rather than the hex string, so the
same key written in different cases fingerprints identically.

backup/fingerprint_test.go

@@ -0,0 +1,61 @@
+package backup
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+const validKeyHex = "0000000000000000000000000000000000000000000000000000000000000001"
+
+func TestFingerprintIsStableAndNotTheKey(t *testing.T) {
+	fp, err := FingerprintHex(validKeyHex)
+	if err != nil {
+		t.Fatalf("FingerprintHex: %v", err)
+	}
+	if len(fp) != 64 {
+		t.Fatalf("fingerprint is %d chars, want 64", len(fp))
+	}
+	if strings.EqualFold(fp, validKeyHex) {
+		t.Fatal("fingerprint equals the key")
+	}
+	again, err := FingerprintHex(validKeyHex)
+	if err != nil {
+		t.Fatalf("FingerprintHex: %v", err)
+	}
+	if fp != again {
+		t.Fatal("fingerprint is not stable across calls")
+	}
+}
+
+func TestFingerprintDiffersPerKey(t *testing.T) {
+	other := "0000000000000000000000000000000000000000000000000000000000000002"
+	a, err := FingerprintHex(validKeyHex)
+	if err != nil {
+		t.Fatalf("FingerprintHex: %v", err)
+	}
+	b, err := FingerprintHex(other)
+	if err != nil {
+		t.Fatalf("FingerprintHex: %v", err)
+	}
+	if a == b {
+		t.Fatal("two different keys produced the same fingerprint")
+	}
+}
+
+func TestParseKeyRejections(t *testing.T) {
+	if _, err := ParseKey(""); !errors.Is(err, ErrNoKey) {
+		t.Fatalf("empty key: got %v, want ErrNoKey", err)
+	}
+	for _, bad := range []string{"zz", validKeyHex[:62], validKeyHex + "00"} {
+		if _, err := ParseKey(bad); !errors.Is(err, ErrBadKey) {
+			t.Fatalf("key %q: got %v, want ErrBadKey", bad, err)
+		}
+	}
+}
+
+func TestParseKeyAcceptsUppercase(t *testing.T) {
+	if _, err := ParseKey(strings.ToUpper(validKeyHex)); err != nil {
+		t.Fatalf("uppercase hex rejected: %v", err)
+	}
+}