wrap_dek(
dek_raw,ed25519_pk) ->slot
Wrap a DEK for an Ed25519 public key
Seals the 32-byte raw DEK so that only the holder of the corresponding Ed25519 private key can recover it. Converts the public key to X25519, performs ECDH with an ephemeral keypair, derives a KEK via HKDF-SHA256, and encrypts the DEK with ChaCha20-Poly1305. Returns a key slot table with fields: fingerprint, ephemeral_pk, nonce, wrapped_dek, tag.