deps: migrate to go-did-it under the ucan-wg org

[MichaelMure]

go-did-it moved from github.com/MetaMask/go-did-it to github.com/ucan-wg/go-did-it. The version jump carries two breaking changes for consumers, one of which the compiler does not catch.

BREAKING: key algorithms must now be registered

crypto.DefaultKeyPolicy starts empty, so a binary that registers nothing builds fine and then fails at runtime on the first DID parse or token verification:

key type not accepted by the key policy: the key policy is empty

Register with a blank import in main, or in each test binary:

import _ "github.com/ucan-wg/go-did-it/crypto/all"

or narrowly, with crypto.Register(ed25519.KeyType()). This is a separate axis from the DID method registration (_ ".../verifiers/did-key"), which was already required and remains so.

BREAKING: the signing entry points take a wider key interface

Upstream split Varsig() out of PrivateKeySigningBytes into its own PrivateKeyVarsig interface. Signing a UCAN envelope needs both capabilities on the same key, because the varsig is computed before signing and is part of the signed bytes, so go-did-it now exposes the composite and go-ucan asks for it:

crypto.PrivateKeySigningBytes -> crypto.PrivateKeySigningBytesVarsig

This affects ToSealed, ToSealedWriter, Encode, EncodeWriter, ToDagCbor, ToDagCborWriter, ToDagJson and ToDagJsonWriter on delegation.Token and invocation.Token, the token.Marshaller interface, client.NewClient, client.NewWithIssuer and issuer.NewRootIssuer. Callers passing a concrete key are unaffected; callers holding a value declared as crypto.PrivateKeySigningBytes widen the declaration.

Consumers that serialize keys through the base interfaces are affected upstream as well: ToPKCS8DER/PEM moved to crypto.PrivateKeyPKCS8, and ToX509DER/PEM to crypto.PublicKeyX509.

Requires Go 1.25.

The wire format is unchanged: the interop vectors and the delegationtest fixtures still decode and verify.

[Copilot]

🟢 Approval recommended

The migration, API updates, registrations, and dependency metadata are covered with no unresolved blocking issues.

Pull request overview

Migrates go-ucan to github.com/ucan-wg/go-did-it, updating signing interfaces, registrations, examples, tests, and dependency metadata.

Changes:

• Replaces MetaMask module imports with the ucan-wg module.
• Updates signing and marshalling APIs to PrivateKeySigningBytesVarsig.
• Registers key algorithms and requires Go 1.25.

File summaries

File	Summary
toolkit/server/extargs/http_test.go	Updated DID test import.
toolkit/server/exectx/ucanctx_test.go	Updated DID imports and crypto registration.
toolkit/server/exectx/middlewares.go	Migrated DID import.
toolkit/server/exectx/middlewares_test.go	Updated DID test import.
toolkit/server/bearer/bearer_test.go	Updated DID imports and crypto registration.
toolkit/issuer/root_issuer.go	Updated imports and signing interface.
toolkit/issuer/http_wrapper.go	Migrated DID import.
toolkit/client/requester.go	Migrated DID import.
toolkit/client/proof.go	Migrated DID import.
toolkit/client/proof_test.go	Updated DID test import.
toolkit/client/pool.go	Migrated DID import.
toolkit/client/clientissuer.go	Updated imports and signing interface.
toolkit/client/client.go	Updated imports and signing interface.
toolkit/client/client_test.go	Updated imports and crypto registration.
toolkit/_example/shared_values.go	Updated key interface types.
toolkit/_example/service/service.go	Updated imports and registered algorithms.
toolkit/_example/service-issuer/issuer.go	Updated dependency, registration, and key type.
toolkit/_example/bob-client/bob.go	Updated dependency and crypto registration.
toolkit/_example/alice-client-issuer/alice.go	Updated dependency, registration, and key type.
toolkit/_example/_protocol-issuer/requester.go	Migrated DID import.
toolkit/_example/_protocol-issuer/request-resolver.go	Migrated DID import.
token/read.go	Migrated DID import.
token/invocation/schema_test.go	Updated crypto dependency and key type.
token/invocation/options.go	Migrated DID import.
token/invocation/ipld.go	Updated DID imports and signing interfaces.
token/invocation/invocation.go	Migrated DID import.
token/invocation/invocation_test.go	Updated dependency and crypto registration.
token/invocation/examples_test.go	Migrated DID imports.
token/internal/parse/parse.go	Migrated DID import.
token/internal/envelope/ipld.go	Updated DID imports and signing interfaces.
token/internal/envelope/ipld_test.go	Updated imports and registrations.
token/internal/envelope/example_test.go	Updated crypto imports and key type.
token/interface.go	Updated marshalling interfaces.
token/delegation/schema_test.go	Updated DID test import.
token/delegation/ipld.go	Updated DID imports and signing interfaces.
token/delegation/interop_test.go	Updated crypto dependency and key type.
token/delegation/examples_test.go	Updated DID test import.
token/delegation/delegationtest/token.go	Updated registrations.
token/delegation/delegationtest/generator/main.go	Updated DID test import.
token/delegation/delegationtest/generator/generator.go	Updated imports and key type.
token/delegation/delegation.go	Updated specification link and DID import.
token/delegation/delegation_test.go	Updated imports and crypto registration.
Readme.md	Updated the upstream project link.
pkg/container/serial_test.go	Updated imports and crypto registration.
go.sum	Refreshed dependency checksums.
go.mod	Updated dependencies and Go version requirement.

Review details

• Files reviewed: 45/46 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.