fix: close immutable promotion trust gaps

scripts/lib/provider-evidence.ts

@@ -1,4 +1,4 @@
-import { verify, type KeyLike } from "node:crypto";
+import { verify, type KeyObject } from "node:crypto";
 
 import { z } from "zod";
 
@@ -56,7 +56,7 @@ export const providerVerificationArtifactSchema = z
 
 export type ProviderTrust = Readonly<{
   keyId: string;
-  publicKey: KeyLike;
+  publicKey: KeyObject;
 }>;
 
 export type PromotionEvidenceResult = Readonly<{
@@ -182,7 +182,13 @@ function signatureMatches(
   >,
   trust: ProviderTrust | null,
 ): boolean {
-  if (!trust || evidence.signature.keyId !== trust.keyId) return false;
+  if (
+    !trust ||
+    evidence.signature.keyId !== trust.keyId ||
+    trust.publicKey.asymmetricKeyType !== "ed25519"
+  ) {
+    return false;
+  }
   try {
     return verify(
       null,