pub fn control_key_from_signer(signer: &dyn Signer) -> [u8; 32]
Derive the deployment-local HMAC key used for authenticated control files.