[lloydmak99]

NVIDIA's public signing key set can exceed the 64 KiB download limit because it includes certificate chains for retained keys. When the download exceeds that limit, GPU attestation fails before signature verification can start.

Raise the signing key set limit to 1 MiB. Signature, issuer, time, nonce, and per-GPU digest checks continue to apply. The regression test serves a large key set over HTTP and verifies a signed GPU attestation with it.

Validation

• Reproduced the size rejection with the old limit and passed the same test with the new limit.
• Services unit suite passed with one test thread (1,221 passed, 2 ignored). Two admin settings tests failed in the parallel run.
• Services Clippy, formatting, and dependency guards passed.

[ironloopai]

Review · Status

⬛ Stopped

IronLoop stopped because the pull request was closed while this Run was active.

Run details

• Run: 713623d7-dc55-4245-bd32-9b6a4271f087
• Base: main at 87ec162
• Head: fix/nras-jwks-size-limit at 3412951
• Created: 2026-11-14 00:41 UTC
• Updated: 2026-11-14 00:45 UTC

_{Automatic trigger · attempt 1 of 3 · stopped after 3m 49s}