GeezerVison

The sign pipe could only sign with RSA keys: it never passed a
signature method to pybergshamra, which then defaulted to rsa-sha256,
and the PKCS#11 path hardcoded RSA_SHA256. EC and Ed25519 keys failed
with "key type does not match algorithm".

The signature method is now chosen from the key type:

  RSA              rsa-sha256
  EC P-256         ecdsa-sha256
  EC P-384         ecdsa-sha384
  EC P-521         ecdsa-sha512
  Ed25519          eddsa-ed25519
  ML-DSA-44/65/87  ml-dsa-* (W3C URI)
  SLH-DSA-SHA2-*   slh-dsa-sha2-* (W3C URI)

New optional sign pipe arguments:

  signature_method  short name (ecdsa-sha384, rsa-pss-sha256,
                    ml-dsa-65-xmlsec, ...) or a full algorithm URI;
                    must match the key type
  digest_method     sha256 (default), sha384, sha512, sha3-256,
                    sha3-384, sha3-512 or a URI
  ec_curve          P-256, P-384 or P-521, for ECDSA on a PKCS#11
                    token when no cert is configured

Invalid or mismatched values fail before any key is loaded or any
token login happens.

For PKCS#11 keys the key type and curve are read from the configured
cert. Without a cert or signature_method, rsa-sha256 is used as
before, so existing HSM configurations are unchanged. ML-DSA and
SLH-DSA are rejected on tokens since the pybergshamra PKCS#11 signer
does not support them.

certreport now applies size limits per key family: error_bits and
warning_bits (1024/2048) apply to RSA and DSA only, EC keys use the
new ec_error_bits (224) and ec_warning_bits (256), and EdDSA, ML-DSA
and SLH-DSA keys are not size checked. CertInfo gains key_family,
derived from the SubjectPublicKeyInfo OID, and keysize no longer
raises for key types cryptography cannot load (e.g. SLH-DSA), so
those certificates still get the expiry check.

The algorithm tables and selection logic live in the new module
pyff/sigalg.py. Tests cover sign and verify round trips for every key
type on both the document root and subtree paths, the overrides,
mocked PKCS#11 algorithm and curve selection, real signing on a
SoftHSM2 token with RSA, EC P-256 and Ed25519 keys (skipped when
SoftHSM2 or pkcs11-tool is missing), and certreport. ML-DSA-65 and
SLH-DSA-SHA2-128s test fixtures are copied from bergshamra
(BSD-2-Clause).