**Released 30 August 2026.** A certification authority key can now stay on a
hardware token; every exception the library raises now carries a class you can
catch; RFC 3161 time stamping works against authorities that are not RSA; and
one background thread has left every process that does symmetric cryptography.

---

## A CA KEY THAT NEVER ENTERS YOUR PROCESS

The headline of this release is PKCS#11 support. Name the vendor module and the
token, and `TstKeyStoragePkcs11` resolves keys from a Cryptoki 2.40 device the
way the library already resolves them from a PFX. The private key is generated
**on** the token, marked non-extractable, and never enters your process — every
signature is computed by the device.

Issuing needed no new code. `TstBaseCertificateGenerator` already signs through
the private-key interface, so a CA key on a token issues certificates exactly as
one in a PFX does, and so do the CSR, CRL and OCSP generators.

RSA and ECDSA both — PKCS#1 v1.5 and PSS, P-256/384/521. What a given device can
actually do is **read from the device** rather than assumed: the mechanism list
is queried at open, and a request the token cannot serve is refused with a
message naming the mechanism instead of failing somewhere further down. Tokens
differ enormously; one that signs SHA-256 may have no SHA-384 at all.

The credential is length-checked against the token's declared range before
anything is sent, so a mistyped passphrase cannot burn one of the few tries that
stand between the token and being locked.

One source, Windows and POSIX: the palette component is available for Win32,
Win64, Linux64 and macOS. It is not offered for iOS or Android, which do not
permit loading an arbitrary vendor module.

Alongside it, and useful on its own: `tExternalDLPrivateKey` gives EC keys the
out-of-process hook RSA keys have had for years.

## TYPED EXCEPTIONS THROUGHOUT

Every `raise` in the library now carries a class from a per-layer hierarchy
rather than a bare `Exception`, so you can catch what you meant to catch. Six
raises that never fired now do — see the BEHAVIOUR CHANGE note in `CHANGES.txt`
before upgrading.

## TIME STAMPING, REVOCATION AND CERTIFICATES

- `TstTimeStampClient` could not verify a token from **any** authority that
  signs with something other than RSA. Fixed, and it is now on the component
  palette with an icon at all three sizes.
- `TsaCertificate` verifies tokens that carry no signer certificate of their own.
- `TstOcspServer.ResponderCertificate` signs with a delegated responder key.
- `id-pkix-ocsp-nocheck` and `organizationIdentifier` are recognised.
- AES-GCM and AES-CCM now have algorithm identifiers, so CMS can name them.
- OID naming: a runtime registration no longer overrides a built-in name.

## SERVING WITHOUT A SECOND HTTP STACK

`StreamSec.Mobile.PlainTextResources` publishes exactly the small set of things
that must be served over cleartext http — CRLs, OCSP responses, AIA and CPS
documents — without standing up a second HTTP stack beside your TLS one.
`HttpSendStream` and friends serve static content properly over a stream you
already hold, with range requests and validators. `TsmRESTClient.TLSEngine`
keeps one TLS engine across calls instead of building a cold one every time.

## ONE FEWER THREAD, AND A SHORTER BILL OF MATERIALS

`stBlockCipher` carried an asynchronous CTR keystream generator: a background
thread, created at unit initialization, feeding a cache the cipher had stopped
drawing on. Because `stBlockCipher` sits under every AES and 3DES class, every
application doing symmetric cryptography — which is to say every TLS or SSH
application — was starting that thread for nothing. It is gone. Cipher behaviour
is unchanged.

Removing it also retired the one component in the library whose licence terms
were never stated: a lock-free list attributed to Nexus Database Systems, which
reproduced a copyright line and a URL and nothing else. It reached every build
that did symmetric cryptography. It now reaches none, and the SBOM lists it as
excluded.

**What a normal build's notices file now amounts to:** a single MIT notice, for
the BearSSL constant-time primitives that keep AES and GHASH free of
secret-dependent table lookups. No copyleft-licensed code. The Gladman AES
assembler carries the one documentation-attribution clause in the library and is
in its own opt-in unit. As always, the authority for any of this is the
CycloneDX document that ships with the release, not this announcement.

## UPGRADING

Two public identifiers are gone: `tBlockCipher.KeyStreamGenerator` and the
`iGenerateKeyStream` interface. Only code that named them needs editing, and
only to delete the reference — assigning a `KeyStreamGenerator` never affected
the data that came out of the cipher. `tBlockCipher.GenerateKeyStream` is
unaffected.

Code that **implements** `iDLPrivateKey` rather than merely consuming it needs
the new `ExternalKey` member.

Full detail, including the BEHAVIOUR CHANGE notes, is in `CHANGES.txt`.