Cloning is deliberate: a holder that must both hand the identity to
the MAC and retain signing ability (e.g. standalone node-identity
bundles) keeps a clone rather than round-tripping secret bytes.
Return true if pk’s bytes decode to a valid Ed25519 compressed
public-key point on the curve. Used by the MAC layer and CLI to reject
malformed peer keys before they can poison the peer registry.
Verify a detached Ed25519 signature against pk. Used for standalone
node-identity bundles (QR codes, broadcasts) whose signed range must
verify before the bundle’s claims are presented as authenticated.