D054 - The key blobs are computed, and the proof is that they come out byte-identical to real packages

Entries 0x10 and 0x20 carry the key material a console unwraps to reach the filesystem. This crate used to demand them from the caller, and a caller with nothing to hand supplied zeros - which produces a package that parses, extracts, and passes every test here, and that a console cannot open at all. It was the one defect certain to be fatal on hardware.

Producing them needs only the public halves of the seven package keys. A public key wraps and cannot unwrap, so nothing here gained the ability to read anything it could not read before; what it gained was the ability to write.

The padding is the interesting part. It looks like PKCS#1 block type 2 but the filler comes from a Mersenne Twister seeded from the modulus and the payload, so it is deterministic - the right answer is a specific 2048 bytes. That makes the check much stronger than a round trip: examples/wrap_keys.rs compares against real packages and gets 2048 of 2048 and 256 of 256 bytes identical on two independent samples. A self-consistently wrong implementation passes a round trip; it cannot pass this.

The seven moduli were extracted from LibOrbisPkg/Util/Keys.cs by a parser, not by hand - transcription of key material had already failed four times in this work (D047). The generator cross-checks its index 3 against the dk3 modulus already committed, which arrived by a different route, and refuses to emit unless they are identical. They are.