Proposal: add generic interface for external key registries about biscuit-rust

[divarvel]

Hi, this looks similar to an open PR in biscuit-go biscuit-auth/biscuit-go#130

The token format still requires to have access to the private key for non-authority blocks, but I think that would be okay in this scenario, we only care about delegating signature to a KMS for the authority block (and third-party blocks, but that's similar).

Agree on putting it behind a feature flag because this increases the risk of misuse a lot.

[ShockleyJE]

Adding an external sign interface would be the minimal solution. The requirement for direct private key access is the main limiting factor of being able to integrate biscuits with modern key management systems, where direct access to the private key is not possible

I would add a stretch goal to ensure that verify functionality, in addition to sign, is able to be externalized from biscuits as well.

Some users will want to use their key management service's verify functionality, and some will want to cache public keys locally rather than making that network request on each verification.

Thanks for the work you do 🙏 No urgency from our side to accommodate this use case- we may return to biscuits for our use case at a later time