Struct KeyTag 

pub struct KeyTag;

The cleartext prefix every sealed payload carries ahead of its ciphertext, naming the key it is under:

[0..3]  marker `CKF`
[3]     format version
[4..36] the key's full SHA-256 fingerprint

Naming the key rather than assuming the current one is what keeps a payload openable across any number of later rotations and forks: a reader resolves whichever key the payload names, and a key once held is never dropped. Every sealed form in the system — a host’s app data, a stored blob, an encrypted protocol object — carries this one tag, so which key a stored byte string wants is one question with one answer, not a per-producer convention.

The tag says only which key; how to reach that key stays with the caller, because it differs by kind — app data resolves the fingerprint against the keyring directly, a scoped blob re-derives its scope key from the master key the fingerprint names.

Implementations

impl KeyTag

pub const LEN: usize

pub fn write(fingerprint: &[u8; 32]) -> Vec<u8>

pub fn read(stored: &[u8]) -> Result<([u8; 32], &[u8]), KeyTagError>

Split stored into the key fingerprint its tag names and the body that follows it.