add BLS proof of possession control

[chunkitmax]

Note

Adds per-key BLS Proof of Possession gated by allow_proof_of_possession, enforces it in POP endpoint, updates CLI listing, tests, and documentation.

• Core/Policy:
  • Add per-key POP control via PublicKeyPolicy.AllowProofOfPossession; enforce in ProvePossession (reject when disabled; improved errors).
  • Map new config flag only for tz4 keys; warn when set on non-BLS keys.
• Config:
  • Extend TezosPolicy with yaml:"allow_proof_of_possession".
• CLI:
  • Update list template to display Allow Proof of Possession.
• Tests:
  • Add unit tests for POP allow/deny/unsupported cases.
  • Enable POP for a tz4 key in integration configs.
• Docs:
  • Add docs/proof_of_possession.md and link from README and start.md.

^{Written by Cursor Bugbot for commit 51fcb2f. This will update automatically on new commits. Configure here.}

[cloudflare-workers-and-pages]

Deploying signatory with    Cloudflare Pages

Latest commit:	01c77ac
Status:	✅  Deploy successful!
Preview URL:	https://30fd3c65.signatory.pages.dev
Branch Preview URL:	https://665-bls-pop-control.signatory.pages.dev

View logs

[michaelkernaghan]

Proof that POP is working in the branch:

set allow POP in the yaml, the check with cli list

Public Key Hash: tz4RA7FyhGmNm5brkKoDUP76gvcbH769gRud
Reference:
Vault: File
Active: true
Allowed Requests: [attestation attestation_with_dal block generic preattestation]
Allowed Operations: [delegation reveal stake transaction update_consensus_key]
Allow Proof of Possession: true

also, if you allow POP for a non BLS key it will show false, which is correct

[michaelkernaghan]

LGTM. i check that it is working by pulling the branch and running the code.

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Protocol Version Comparison Fails

The protocol version comparison using strings.Compare() is unreliable. Tezos protocol hashes are base58-encoded identifiers whose lexicographical order doesn't reflect chronological version progression. Comparing a full hash against a partial string further compounds this, potentially causing tests to run or skip on incorrect protocol versions.