- Add contrib/make_welist_txt.sh to print the _welist-key TXT
name, value and BIND zone line for a domain and Ed25519 key
- Accept a private/public PEM file or an existing base64 SPKI DER
- Generate private_key.pem and public_key.pem when the key argument
is omitted, reusing an existing private key
- Document the helper in docs/10_dnssec_key_publishing.md
- Load WELIST_PING_DELEGATION_FILE into a typed OnionDelegation
- Send the certificate only with v2 pings for onion hosts
- Validate the onion host, expiry and delegated key against
BAL_SERVER_URL and SSL_KEY_PATH at startup; disable delegation
with a warning on any mismatch
- Stop sending unsigned info/base_fee/version with v1 pings so
v1 remains liveness-only
- Document v1/v2 metadata handling and onion delegation implications
- Add contrib/make_onion_delegation.py to issue certificates offline,
with Ed25519 key validation and clean CLI error handling
