CoreCryptoCentral

Adds every certificate from pemBundle that is not already installed. Existing trust anchors are never removed.

Check all installed X509 credentials for expiration and revocation.

Close Core Crypto, its PKI environment, and its database after their users have stopped. A native close failure remains a failure on later calls; the account owner must retain its lease because the native binding cannot confirm successful release by retrying.

Creates and installs a PKI environment backed by the same encrypted database as Core Crypto.

Export a compacted copy of the CoreCrypto database to the specified destination path. Uses SQLite's VACUUM INTO to create an encrypted copy of the database.

Read installed credentials without initializing a client or creating key material.

Persists credential without taking ownership of it.

Starts an X509 acquisition and keeps it alive while PkiEnvironmentHooks.authenticate performs authentication. existingCredentialRef remains valid after this call.