What this changes

JWK._require_key_material only enforced that public key fields were present — it never blocked private key parameters (d, p, q, dp, dq, qi, k) from being stored in cnf.jwk. With extra="allow" on the model, a record carrying private key material passed model_validate() silently. Added _JWK_PRIVATE_PARAMS constant and a check in the validator that raises if any private parameter is present. Added one regression test.

Type of change

• Editorial (typo, link fix, clarification — no normative effect)
• [x ] Non-breaking spec change (new optional field, new platform profile, informative addition)
• Breaking spec change (requires 14-day comment period and Project Lead sign-off)
• Schema change
• Example addition

Spec section

§3.2.1 Signing and key management

Checklist

• DCO sign-off on all commits (git commit -s)
• CHANGELOG.md updated (for any normative change)
• Breaking changes marked with <!-- CHANGED: #NNN — description --> in spec text
• Backward compatibility statement included (for breaking changes)