Imports public key material for simple or composite (hybrid) cryptographic keys.

Public-Only Import: This endpoint imports public keys only.
For full key import including private keys, use the PKCS#12 import endpoint.

Supported Key Types:

1. Simple Keys (type="SIMPLE" or omit):

   • RSA, EC, EdDSA, ECDH, ML-KEM, ML-DSA, FALCON, SLH-DSA, etc.
   • Provide publicKey field in Base64 X.509 SubjectPublicKeyInfo format

2. Composite Keys (type="COMPOSITE"):

   • COMPOSITE_KEM_COMBINE: Hybrid encryption (X25519+ML-KEM-768, P-384+ML-KEM-1024, etc.)
   • COMPOSITE_SIGNATURE: Hybrid signatures (Ed25519+ML-DSA-65, P-256+ML-DSA-44, etc.)
   • Provide components array with public keys for each component

Business Rules:

• New key (kid not exists): Creates public-only key → 201 Created
• Existing key, public keys match: Verification only, no updates → 200 OK
• Existing key, public keys differ: Rejected → 409 Conflict
• Composite keys: ALL component public keys must match exactly

keyOps Validation:

Only public-only operations allowed:

• Allowed: encrypt, verify, wrapKey, deriveKey
• Rejected: decrypt, sign, unwrapKey (require private key)
• Algorithm must support the requested operation

Use Cases:

• Import partner/external public keys for signature verification
• Import certificate public keys for encryption
• Share public keys across tenants or systems
• Import hybrid classical+PQC keys for quantum-safe communications