Method SetDKIMCipher

internal/identity/store.go:354–354

SetDKIMCipher enables envelope encryption of DKIM private keys at rest (#144). Optional-setter (matches SetEnforcer/SetPublisher) so NewStore's signature — and the many tests that call NewStore(pool) — stay unchanged. When unset, keys are stored as plaintext DER. cmd/e2a always sets it in production

(c *DKIMCipher)

// are stored as plaintext DER. cmd/e2a always sets it in production, where
// Signing.HMACSecret is enforced ≥32 bytes.
func (s *Store) SetDKIMCipher(c *DKIMCipher) { s.dkimCipher = c }

// sealDKIM encrypts a DKIM private key for storage when a cipher is configured,
// else returns the plaintext DER unchanged. domain is bound as AAD.