Add did-method-key support

* Add comprehensive CLI binary documentation
* Enhanced atproto-identity-resolve.rs with detailed usage examples and configuration options
* Added complete documentation for atproto-identity-sign.rs covering IPLD DAG-CBOR signing workflow
* Added comprehensive documentation for atproto-identity-validate.rs with signature verification examples
* Included practical command-line examples, argument descriptions, and error handling details
* Documented supported cryptographic key types (P-256, K-256) and multibase encoding
* Bumping version to 0.2.0

CLAUDE.md

···
 ## Architecture
 
 A comprehensive Rust library with:
-- Modular architecture with 7 core modules (resolve, plc, web, model, validation, config, errors)
+- Modular architecture with 8 core modules (resolve, plc, web, model, validation, config, errors, key)
 - Complete CLI tool for identity resolution (`atproto-identity-resolve`)
 - Rust edition 2021 with modern async/await patterns
 - Comprehensive error handling with structured error types
···
 
 * error-atproto-identity-resolve-1 Multiple DIDs resolved for method
 * error-atproto-identity-plc-1 HTTP request failed: https://google.com/ Not Found
-* error-did-web-1 Invalid DID format: missing 'did:web:' prefix
+* error-atproto-identity-key-1 Error decoding key: invalid
 
 Errors should be represented as enums using the `thiserror` library when possible using `src/errors.rs` as a reference and example.
 
···
 }
 ```
 
-### Logging
+## Result
+
+Functions that return a `Result` type should use `anyhow::Result` where second Error component of is one of the error types defined in `src/errors.rs`.
+
+## Logging
 
 Use tracing for structured logging.
 
···
 - **`src/validation.rs`**: Input validation for handles and DIDs
 - **`src/config.rs`**: Configuration management and environment variable handling
 - **`src/errors.rs`**: Structured error types following project conventions
+- **`src/key.rs`**: Cryptographic key operations including signature validation and key identification for P-256 and K-256 curves
 - **`src/bin/atproto-identity-resolve.rs`**: CLI tool for identity resolution
+
+## Documentation
+
+All public and exported types, methods, and variables must be documented.
+
+All source files must have high level module documentation.
+
+Documentation must be brief and specific.

Cargo.lock

···
 
 [[package]]
 name = "atproto-identity"
-version = "0.1.1"
+version = "0.2.0"
 dependencies = [
  "anyhow",
+ "ecdsa",
  "futures-util",
  "hickory-resolver",
+ "k256",
+ "multibase",
+ "p256",
  "reqwest",
  "serde",
+ "serde_ipld_dagcbor",
  "serde_json",
  "thiserror 2.0.12",
  "tokio",
···
 ]
 
 [[package]]
+name = "base-x"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cbbc9d0964165b47557570cce6c952866c2678457aca742aafc9fb771d30270"
+
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
+[[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
+name = "base64ct"
+version = "1.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89e25b6adfb930f02d1981565a6e5d9c547ac15a96606256d3b59040e5cd4ca3"
+
+[[package]]
 name = "bitflags"
 version = "2.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967"
 
 [[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
 name = "bumpalo"
 version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
+name = "cbor4ii"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544cf8c89359205f4f990d0e6f3828db42df85b5dac95d09157a250eb0749c4"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "cc"
 version = "1.2.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
+name = "cid"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3147d8272e8fa0ccd29ce51194dd98f79ddfb8191ba9e3409884e751798acf3a"
+dependencies = [
+ "core2",
+ "multibase",
+ "multihash",
+ "serde",
+ "serde_bytes",
+ "unsigned-varint",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
 name = "core-foundation"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
+name = "core2"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
 name = "critical-section"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
 name = "data-encoding"
 version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a2330da5de22e8a3cb63252ce2abb30116bf5265e89c0e01bc17015ce30a476"
 
 [[package]]
+name = "data-encoding-macro"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47ce6c96ea0102f01122a185683611bd5ac8d99e62bc59dd12e6bda344ee673d"
+dependencies = [
+ "data-encoding",
+ "data-encoding-macro-internal",
+]
+
+[[package]]
+name = "data-encoding-macro-internal"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d162beedaa69905488a8da94f5ac3edb4dd4788b732fadb7bd120b2625c1976"
+dependencies = [
+ "data-encoding",
+ "syn",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
 name = "displaydoc"
 version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "encoding_rs"
 version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+ "zeroize",
+]
+
+[[package]]
 name = "getrandom"
 version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
 name = "h2"
 version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "thiserror 2.0.12",
  "tokio",
  "tracing",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
 ]
 
 [[package]]
···
 ]
 
 [[package]]
+name = "ipld-core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "104718b1cc124d92a6d01ca9c9258a7df311405debb3408c445a36452f9bf8db"
+dependencies = [
+ "cid",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
 name = "ipnet"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "k256"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
+dependencies = [
+ "cfg-if",
+ "ecdsa",
+ "elliptic-curve",
+ "once_cell",
+ "sha2",
+ "signature",
+]
+
+[[package]]
 name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "multibase"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b3539ec3c1f04ac9748a260728e855f261b4977f5c3406612c884564f329404"
+dependencies = [
+ "base-x",
+ "data-encoding",
+ "data-encoding-macro",
+]
+
+[[package]]
+name = "multihash"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b430e7953c29dd6a09afc29ff0bb69c6e306329ee6794700aee27b76a1aea8d"
+dependencies = [
+ "core2",
+ "serde",
+ "unsigned-varint",
+]
+
+[[package]]
 name = "native-tls"
 version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
 
 [[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
 name = "parking_lot"
 version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
 name = "percent-encoding"
 version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
 name = "pkg-config"
 version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
  "zerocopy",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
 ]
 
 [[package]]
···
 checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
 dependencies = [
  "rand_chacha",
- "rand_core",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
···
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.16",
 ]
 
 [[package]]
···
 checksum = "95325155c684b1c89f7765e30bc1c42e4a6da51ca513615660cb8a62ef9a88e3"
 
 [[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
+[[package]]
 name = "ring"
 version = "0.17.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
 [[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
 name = "security-framework"
 version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "serde_bytes"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8437fd221bde2d4ca316d61b90e337e9e702b3820b87d63caa9ba6c02bd06d96"
+dependencies = [
+ "serde",
+]
+
+[[package]]
 name = "serde_derive"
 version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "serde_ipld_dagcbor"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99600723cf53fb000a66175555098db7e75217c415bdd9a16a65d52a19dcc4fc"
+dependencies = [
+ "cbor4ii",
+ "ipld-core",
+ "scopeguard",
+ "serde",
+]
+
+[[package]]
 name = "serde_json"
 version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 ]
 
 [[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
 name = "sharded-slab"
 version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
 name = "slab"
 version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
 ]
 
 [[package]]
···
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
 [[package]]
+name = "typenum"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
+
+[[package]]
 name = "unicode-ident"
 version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
+
+[[package]]
+name = "unsigned-varint"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb066959b24b5196ae73cb057f45598450d2c5f71460e98c49b738086eff9c06"
 
 [[package]]
 name = "untrusted"
···
 version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
 [[package]]
 name = "want"

Cargo.toml

···
 [package]
 name = "atproto-identity"
-version = "0.1.1"
+version = "0.2.0"
 edition = "2021"
 rust-version = "1.83"
 authors = ["Nick Gerakines <[e-mail]>"]
···
 name = "atproto-identity-resolve"
 test = false
 bench = false
+doc = true
+
+[[bin]]
+name = "atproto-identity-sign"
+test = false
+bench = false
+doc = true
+
+[[bin]]
+name = "atproto-identity-validate"
+test = false
+bench = false
+doc = true
 
 [dependencies]
 anyhow = "1.0"
···
 reqwest = { version = "0.12", features = ["json", "rustls-tls"] }
 tracing = { version = "0.1", features = ["async-await"] }
 tokio = { version = "1.41", features = ["macros", "rt", "rt-multi-thread"] }
+multibase = "0.9.1"
+ecdsa = { version = "0.16.9", features = ["std"] }
+k256 = "0.13.4"
+p256 = "0.13.2"
+serde_ipld_dagcbor = "0.6.3"

README.md

···
 - **DID Document Retrieval**: Fetch and parse DID documents for `did:plc` and `did:web` identifiers
 - **Multiple Resolution Methods**: Supports both DNS and HTTP-based handle resolution with conflict detection
 - **Configurable DNS**: Custom DNS nameserver support with fallback to system defaults
+- **Cryptographic Key Operations**: Support for P-256 and K-256 key identification, signature validation, and signing
 - **Structured Logging**: Built-in tracing support for debugging and monitoring
 - **Type Safety**: Comprehensive error handling with structured error types
 
···
 
 ```toml
 [dependencies]
-atproto-identity = "0.1.0"
+atproto-identity = "0.2.0"
 ```
 
 ## Usage
···
 }
 ```
 
+### Cryptographic Key Operations
+
+The `key` module provides utilities for working with cryptographic keys:
+
+```rust
+use atproto_identity::key::{identify_key, validate, KeyType};
+
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // Identify a key from a DID key string
+    let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
+    
+    match key_data.0 {
+        KeyType::K256Public => println!("K-256 public key"),
+        KeyType::P256Public => println!("P-256 public key"),
+        KeyType::K256Private => println!("K-256 private key"),
+        KeyType::P256Private => println!("P-256 private key"),
+    }
+    
+    // Validate a signature (example with dummy data)
+    let content = b"hello world";
+    let signature = vec![0u8; 64]; // Replace with actual signature
+    validate(&key_data, &signature, content)?;
+    
+    Ok(())
+}
+```
+
 ### Configuration
 
 The library supports various configuration options through environment variables:
···
 - **validation**: Input validation for handles and DIDs
 - **config**: Configuration management and environment variable handling
 - **errors**: Structured error types following project conventions
+- **key**: Cryptographic key operations including signature validation and key identification for P-256 and K-256 curves
 
 ## Error Handling
 

src/bin/atproto-identity-resolve.rs

···
     web::query as web_query,
 };
 
+/// AT Protocol Identity Resolution CLI
+///
+/// A command-line tool for resolving AT Protocol handles and DIDs to their canonical
+/// DID identifiers and optionally retrieving their full DID documents. Supports
+/// both did:plc and did:web methods with configurable DNS and HTTP settings.
+///
+/// ## Usage
+///
+/// Resolve one or more handles or DIDs:
+/// ```bash
+/// cargo run --bin atproto-identity-resolve alice.bsky.social
+/// cargo run --bin atproto-identity-resolve did:plc:ewvi7nxzyoun6zhxrhs64oiz
+/// cargo run --bin atproto-identity-resolve alice.bsky.social bob.example.com
+/// ```
+///
+/// Resolve and fetch DID documents:
+/// ```bash
+/// cargo run --bin atproto-identity-resolve --did-document alice.bsky.social
+/// cargo run --bin atproto-identity-resolve --did-document did:web:example.com
+/// ```
+///
+/// ## Arguments
+///
+/// - `[SUBJECTS]...` - One or more AT Protocol handles or DIDs to resolve
+/// - `--did-document` - Additionally fetch and display the full DID document
+///
+/// ## Environment Variables
+///
+/// - `PLC_HOSTNAME` - PLC directory hostname (default: "plc.directory")
+/// - `USER_AGENT` - HTTP user agent string (default: auto-generated)
+/// - `CERTIFICATE_BUNDLES` - Colon-separated paths to additional CA certificates
+/// - `DNS_NAMESERVERS` - Comma-separated DNS nameserver addresses
+///
+/// ## Examples
+///
+/// Basic handle resolution:
+/// ```bash
+/// $ cargo run --bin atproto-identity-resolve alice.bsky.social
+/// did:plc:ewvi7nxzyoun6zhxrhs64oiz
+/// ```
+///
+/// Resolve multiple subjects:
+/// ```bash
+/// $ cargo run --bin atproto-identity-resolve alice.bsky.social bob.example.com
+/// did:plc:ewvi7nxzyoun6zhxrhs64oiz
+/// did:web:bob.example.com
+/// ```
+///
+/// Get DID document:
+/// ```bash
+/// $ cargo run --bin atproto-identity-resolve --did-document alice.bsky.social
+/// did:plc:ewvi7nxzyoun6zhxrhs64oiz
+/// PlcDocument { did: "did:plc:ewvi7nxzyoun6zhxrhs64oiz", ... }
+/// ```
 #[tokio::main]
 async fn main() -> Result<()> {
     let plc_hostname = default_env("PLC_HOSTNAME", "plc.directory");
···
             continue;
         }
 
-        let did_document = match parse_input(&resolved_did) {
-            Ok(InputType::Plc(did)) => plc_query(&http_client, &plc_hostname, &did).await,
-            Ok(InputType::Web(did)) => web_query(&http_client, &did).await,
+        let did_document: Result<_, anyhow::Error> = match parse_input(&resolved_did) {
+            Ok(InputType::Plc(did)) => plc_query(&http_client, &plc_hostname, &did)
+                .await
+                .map_err(Into::into),
+            Ok(InputType::Web(did)) => web_query(&http_client, &did).await.map_err(Into::into),
             Ok(InputType::Handle(_)) => {
                 eprintln!("error: subject resolved to handle");
                 continue;

src/bin/atproto-identity-sign.rs

···
+use anyhow::{anyhow, Context, Result};
+use atproto_identity::key::{identify_key, sign};
+use std::{env, fs::File, io::BufReader};
+
+use std::process::ExitCode;
+
+async fn real_main() -> Result<()> {
+    let mut arguments = env::args().skip(1); //. .collect::<Vec<String>>();
+
+    if arguments.len() != 2 {
+        return Err(anyhow!("Usage: atproto-identity-sign [did-key] [file]"));
+    }
+
+    let key_data = arguments
+        .next()
+        .ok_or(anyhow!("missing did-method-key value"))?;
+    let identified_key = identify_key(&key_data)?;
+
+    let json_file_path = arguments.next().ok_or(anyhow!("missing json-file value"))?;
+    let record: serde_json::Value = File::open(json_file_path)
+        .context("failed to open json file")
+        .map(BufReader::new)
+        .and_then(|value| serde_json::from_reader(value).context("failed to parse json file"))?;
+
+    let serialized_record = serde_ipld_dagcbor::to_vec(&record)?;
+
+    let signature = sign(&identified_key, &serialized_record)?;
+    let encoded_signature = multibase::encode(multibase::Base::Base64Url, &signature);
+
+    println!("{encoded_signature}");
+
+    Ok(())
+}
+
+/// AT Protocol Digital Signature CLI
+///
+/// A command-line tool for creating cryptographic signatures of JSON data using
+/// AT Protocol DID keys. Takes a JSON file, serializes it using IPLD DAG-CBOR
+/// format, and produces a multibase-encoded signature using the specified key.
+/// Supports both P-256 and K-256 elliptic curve keys via did:key method.
+///
+/// ## Usage
+///
+/// ```bash
+/// cargo run --bin atproto-identity-sign [DID_KEY] [JSON_FILE]
+/// ```
+///
+/// ## Arguments
+///
+/// - `DID_KEY` - A did:key identifier containing the signing key (e.g., did:key:z42tv1pb3...)
+/// - `JSON_FILE` - Path to a JSON file containing the data to sign
+///
+/// ## Process
+///
+/// 1. Parses and validates the provided DID key
+/// 2. Reads and parses the JSON file
+/// 3. Serializes the JSON data using IPLD DAG-CBOR encoding
+/// 4. Creates a cryptographic signature using the specified key
+/// 5. Encodes the signature using multibase Base64URL format
+/// 6. Outputs the encoded signature to stdout
+///
+/// ## Examples
+///
+/// Create a sample JSON file and sign it:
+/// ```bash
+/// # Create test data
+/// $ echo '{"message": "hello world", "timestamp": "2024-01-01T00:00:00Z"}' > data.json
+///
+/// # Sign the data
+/// $ cargo run --bin atproto-identity-sign did:key:z42tv1pb3Dzog28Q1udyieg1YJP3x1Un5vraE1bttXeCDSpW data.json
+/// uEiABC123...XYZ789
+/// ```
+///
+/// Using jo to create JSON and sign in one command:
+/// ```bash
+/// $ jo message="hello world" when="$(date)" > message.json
+/// $ cargo run --bin atproto-identity-sign did:key:z42tv1pb3... message.json
+/// uEiBDE456...ABC123
+/// ```
+///
+/// ## Supported Key Types
+///
+/// - **P-256 (secp256r1)** - NIST standard elliptic curve
+/// - **K-256 (secp256k1)** - Bitcoin/Ethereum compatible curve
+///
+/// ## Error Handling
+///
+/// - Invalid DID key format or unsupported key type
+/// - Missing or unreadable JSON file
+/// - Malformed JSON content
+/// - Cryptographic signing failures
+///
+/// All errors are reported to stderr with descriptive messages.
+#[tokio::main]
+async fn main() -> ExitCode {
+    if let Err(err) = real_main().await {
+        eprintln!("{err}");
+        return ExitCode::from(1);
+    }
+    ExitCode::from(0)
+}

src/bin/atproto-identity-validate.rs

···
+use anyhow::{anyhow, Context, Result};
+use atproto_identity::key::{identify_key, validate};
+use std::{env, fs::File, io::BufReader};
+
+use std::process::ExitCode;
+
+async fn real_main() -> Result<()> {
+    let mut arguments = env::args().skip(1); //. .collect::<Vec<String>>();
+
+    if arguments.len() != 3 {
+        return Err(anyhow!(
+            "Usage: atproto-identity-validate [did-key] [file] [signature]"
+        ));
+    }
+
+    let key_data = arguments
+        .next()
+        .ok_or(anyhow!("missing did-method-key value"))?;
+    let identified_key = identify_key(&key_data)?;
+
+    let json_file_path = arguments.next().ok_or(anyhow!("missing json-file value"))?;
+    let record: serde_json::Value = File::open(json_file_path)
+        .context("failed to open json file")
+        .map(BufReader::new)
+        .and_then(|value| serde_json::from_reader(value).context("failed to parse json file"))?;
+
+    let serialized_record = serde_ipld_dagcbor::to_vec(&record)?;
+
+    let encoded_signature = arguments.next().ok_or(anyhow!("missing signature value"))?;
+
+    let (_, signature_data) = multibase::decode(encoded_signature)?;
+
+    validate(&identified_key, &signature_data, &serialized_record)?;
+
+    Ok(())
+}
+
+/// AT Protocol Signature Validation CLI
+///
+/// A command-line tool for verifying cryptographic signatures of JSON data using
+/// AT Protocol DID keys. Takes a JSON file, a multibase-encoded signature, and
+/// a DID key, then validates that the signature was created by the specified key
+/// for the given data. Uses IPLD DAG-CBOR serialization format for verification.
+/// Supports both P-256 and K-256 elliptic curve keys via did:key method.
+///
+/// ## Usage
+///
+/// ```bash
+/// cargo run --bin atproto-identity-validate [DID_KEY] [JSON_FILE] [SIGNATURE]
+/// ```
+///
+/// ## Arguments
+///
+/// - `DID_KEY` - A did:key identifier containing the verification key (e.g., did:key:z42tv1pb3...)
+/// - `JSON_FILE` - Path to a JSON file containing the original signed data
+/// - `SIGNATURE` - Multibase-encoded signature to validate (typically Base64URL)
+///
+/// ## Process
+///
+/// 1. Parses and validates the provided DID key
+/// 2. Reads and parses the JSON file
+/// 3. Serializes the JSON data using IPLD DAG-CBOR encoding (same as signing)
+/// 4. Decodes the multibase-encoded signature
+/// 5. Verifies the signature against the data using the specified key
+/// 6. Outputs "OK" on successful validation, error message on failure
+/// 7. Returns exit code 0 for success, 1 for failure
+///
+/// ## Examples
+///
+/// Basic signature validation workflow:
+/// ```bash
+/// # Create and sign data
+/// $ echo '{"message": "hello world", "timestamp": "2024-01-01T00:00:00Z"}' > data.json
+/// $ SIGNATURE=$(cargo run --bin atproto-identity-sign did:key:z42tv1pb3... data.json)
+///
+/// # Validate the signature
+/// $ cargo run --bin atproto-identity-validate did:key:z42tv1pb3... data.json $SIGNATURE
+/// OK
+/// ```
+///
+/// Validating a signature from external source:
+/// ```bash
+/// $ cargo run --bin atproto-identity-validate \
+///     did:key:z42tv1pb3Dzog28Q1udyieg1YJP3x1Un5vraE1bttXeCDSpW \
+///     message.json \
+///     uEiABC123defGHI456jklMNO789pqrSTU012vwxYZ345abc
+/// OK
+/// ```
+///
+/// Invalid signature example:
+/// ```bash
+/// $ cargo run --bin atproto-identity-validate did:key:z42tv1pb3... data.json invalid_sig
+/// error-atproto-identity-key-1 Signature validation failed
+/// ```
+///
+/// ## Supported Key Types
+///
+/// - **P-256 (secp256r1)** - NIST standard elliptic curve
+/// - **K-256 (secp256k1)** - Bitcoin/Ethereum compatible curve
+///
+/// ## Error Handling
+///
+/// - Invalid DID key format or unsupported key type
+/// - Missing or unreadable JSON file
+/// - Malformed JSON content
+/// - Invalid multibase-encoded signature
+/// - Signature validation failure (wrong key, tampered data, etc.)
+///
+/// All errors are reported to stderr with descriptive messages and return exit code 1.
+/// Successful validation prints "OK" to stdout and returns exit code 0.
+#[tokio::main]
+async fn main() -> ExitCode {
+    if let Err(err) = real_main().await {
+        eprintln!("{err}");
+        return ExitCode::from(1);
+    }
+    println!("OK");
+    ExitCode::from(0)
+}

src/config.rs

···
+//! Configuration management for AT Protocol identity operations.
+//!
+//! Provides utilities for reading environment variables, parsing configuration values,
+//! and managing DNS nameservers and TLS certificate bundles. Supports fallback defaults
+//! and structured error handling for missing or invalid configuration.
+
 use crate::errors::ConfigError;
 use anyhow::Result;
 

src/errors.rs

···
 #[derive(Debug, Error)]
 pub enum WebDIDError {
     /// Occurs when the DID is missing the 'did:web:' prefix
-    #[error("error-did-web-1 Invalid DID format: missing 'did:web:' prefix")]
+    #[error("error-atproto-identity-web-1 Invalid DID format: missing 'did:web:' prefix")]
     InvalidDIDPrefix,
 
     /// Occurs when the DID is missing a hostname component
-    #[error("error-did-web-2 Invalid DID format: missing hostname component")]
+    #[error("error-atproto-identity-web-2 Invalid DID format: missing hostname component")]
     MissingHostname,
 
     /// Occurs when the HTTP request to fetch the DID document fails
-    #[error("error-did-web-3 HTTP request failed: {url} {error}")]
+    #[error("error-atproto-identity-web-3 HTTP request failed: {url} {error}")]
     HttpRequestFailed {
         /// The URL that was requested
         url: String,
···
     },
 
     /// Occurs when the DID document cannot be parsed from the HTTP response
-    #[error("error-did-web-4 Failed to parse DID document: {url} {error}")]
+    #[error("error-atproto-identity-web-4 Failed to parse DID document: {url} {error}")]
     DocumentParseFailed {
         /// The URL that was requested
         url: String,
···
 pub enum ConfigError {
     /// Occurs when a required environment variable is not set
     #[error("error-atproto-identity-config-1 Required environment variable not found: {name}")]
-    MissingEnvironmentVariable { name: String },
+    MissingEnvironmentVariable {
+        /// The name of the missing environment variable
+        name: String,
+    },
 
     /// Occurs when parsing an IP address from nameserver configuration fails
     #[error("error-atproto-identity-config-2 Unable to parse nameserver IP: {value}")]
-    InvalidNameserverIP { value: String },
+    InvalidNameserverIP {
+        /// The invalid IP address value that could not be parsed
+        value: String,
+    },
 
     /// Occurs when version information cannot be determined
     #[error("error-atproto-identity-config-3 Version information not available: GIT_HASH or CARGO_PKG_VERSION must be set")]
···
     InvalidHTTPResolutionResponse,
 
     /// Occurs when input cannot be parsed as a valid handle or DID
-    #[error("error-atproto-identity-resolve-8 Invalid input")]
+    #[error("error-atproto-identity-resolve-7 Invalid input")]
     InvalidInput,
 }
 
···
         error: reqwest::Error,
     },
 }
+
+/// Error types that can occur when working with cryptographic keys
+#[derive(Debug, Error)]
+pub enum KeyError {
+    /// Occurs when multibase decoding of a key fails
+    #[error("error-atproto-identity-key-1 Error decoding key: {0:?}")]
+    DecodeError(multibase::Error),
+
+    /// Occurs when a key cannot be identified or is in an invalid format
+    #[error("error-atproto-identity-key-2 Invalid key: {0:?}")]
+    InvalidKey(anyhow::Error),
+
+    /// Occurs when ECDSA signature parsing fails
+    #[error("error-atproto-identity-key-3 Signature parsing failed: {0:?}")]
+    SignatureError(ecdsa::signature::Error),
+
+    /// Occurs when P-256 key operations fail
+    #[error("error-atproto-identity-key-4 P256 Error: {0:?}")]
+    P256Error(p256::ecdsa::Error),
+
+    /// Occurs when K-256 key operations fail
+    #[error("error-atproto-identity-key-5 K256 Error: {0:?}")]
+    K256Error(k256::ecdsa::Error),
+
+    /// Occurs when ECDSA cryptographic operations fail
+    #[error("error-atproto-identity-key-6 ECDSA Error: {0:?}")]
+    ECDSAError(ecdsa::Error),
+
+    /// Occurs when secret key parsing or operations fail
+    #[error("error-atproto-identity-key-7 Secret Key Error: {0:?}")]
+    SecretKeyError(ecdsa::elliptic_curve::Error),
+
+    /// Occurs when attempting to sign content with a public key instead of a private key
+    #[error("error-atproto-identity-key-8 Private key required for signature")]
+    PrivateKeyRequiredForSignature,
+}

src/key.rs

···
+//! Cryptographic key operations for AT Protocol identity management.
+//!
+//! This module provides utilities for working with elliptic curve cryptographic keys
+//! used in AT Protocol DID documents and identity verification. Supports both P-256
+//! (secp256r1) and K-256 (secp256k1) curves with operations for key identification,
+//! signature validation, and content signing.
+//!
+//! # Supported Key Types
+//!
+//! - **P-256** (secp256r1/ES256): NIST standard curve, commonly used in web standards
+//! - **K-256** (secp256k1/ES256K): Bitcoin curve, widely used in blockchain applications
+//!
+//! # Key Operations
+//!
+//! - Key type identification from multibase-encoded DID key strings
+//! - ECDSA signature validation for both public and private keys
+//! - Content signing with private keys
+//! - DID key method prefix handling
+//!
+//! # Example
+//!
+//! ```rust
+//! use atproto_identity::key::{identify_key, validate, KeyType};
+//!
+//! # fn main() -> Result<(), Box<dyn std::error::Error>> {
+//! let key_data = identify_key("did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA")?;
+//! assert_eq!(key_data.0, KeyType::K256Public);
+//! # Ok(())
+//! # }
+//! ```
+
+use anyhow::{anyhow, Result};
+use ecdsa::signature::Signer;
+
+use crate::errors::KeyError;
+
+/// Cryptographic key types supported for AT Protocol identity.
+#[derive(Debug, PartialEq)]
+pub enum KeyType {
+    /// A p256 (P-256 / secp256r1 / ES256) public key.
+    /// The multibase / multicodec prefix is 8024.
+    P256Public,
+
+    /// A p256 (P-256 / secp256r1 / ES256) private key.
+    /// The multibase / multicodec prefix is 8626.
+    P256Private,
+
+    /// A k256 (K-256 / secp256k1 / ES256K) public key.
+    /// The multibase / multicodec prefix is e701.
+    K256Public,
+
+    /// A k256 (K-256 / secp256k1 / ES256K) private key.
+    /// The multibase / multicodec prefix is 8126.
+    K256Private,
+}
+
+/// DID key method prefix.
+const DID_METHOD_KEY_PREFIX: &str = "did:key:";
+
+/// Extracts the value portion from a DID key string.
+///
+/// Removes the "did:key:" prefix if present, otherwise returns the original string.
+pub fn did_method_key_value(key: &str) -> &str {
+    match key.strip_prefix(DID_METHOD_KEY_PREFIX) {
+        Some(value) => value,
+        None => key,
+    }
+}
+
+/// Identifies the key type and extracts the key data from a multibase-encoded key.
+///
+/// Returns a tuple containing the key type and the raw key bytes.
+pub fn identify_key(key: &str) -> Result<(KeyType, Vec<u8>), KeyError> {
+    let stripped_key = did_method_key_value(key);
+    let (_, decoded_multibase_key) =
+        multibase::decode(stripped_key).map_err(KeyError::DecodeError)?;
+
+    if decoded_multibase_key.len() < 3 {
+        return Err(KeyError::InvalidKey(anyhow!("unidentified key type")));
+    }
+
+    // These values were verified using the following method:
+    //
+    // 1. Use goat to generate p256 and k256 keys to sample.
+    //    `goat key generate -t k256`
+    //
+    // 2. Use `multibase` and `xxd` to view the hex output
+    //    `multibase decode zQ3shj41kYrAKpgMvWFZ8L4uFhQ6P57zpiQEuvL1LWWa8sZqN | xxd`
+    //
+    // See also: https://github.com/bluesky-social/indigo/tree/main/cmd/goat
+    // See also: https://github.com/docknetwork/multibase-cli
+
+    match &decoded_multibase_key[..2] {
+        // P-256 / secp256r1 / ES256 private key
+        [0x86, 0x26] => Ok((KeyType::P256Private, decoded_multibase_key[2..].to_vec())),
+
+        // P-256 / secp256r1 / ES256 public key
+        [0x80, 0x24] => Ok((KeyType::P256Public, decoded_multibase_key[2..].to_vec())),
+
+        // K-256 / secp256k1 / ES256K private key
+        [0x81, 0x26] => Ok((KeyType::K256Private, decoded_multibase_key[2..].to_vec())),
+
+        // K-256 / secp256k1 / ES256K public key
+        [0xe7, 0x01] => Ok((KeyType::K256Public, decoded_multibase_key[2..].to_vec())),
+
+        _ => Err(KeyError::InvalidKey(anyhow!(
+            "invalid multibase key type: {:?}",
+            &decoded_multibase_key[..2]
+        ))),
+    }
+}
+
+/// Validates a signature against content using the provided key.
+///
+/// Supports both public and private keys for signature verification.
+pub fn validate(
+    key_data: &(KeyType, Vec<u8>),
+    signature: &[u8],
+    content: &[u8],
+) -> Result<(), KeyError> {
+    match key_data.0 {
+        KeyType::P256Public => {
+            let signature =
+                ecdsa::Signature::from_slice(signature).map_err(KeyError::SignatureError)?;
+            let verifying_key = p256::ecdsa::VerifyingKey::from_sec1_bytes(&key_data.1)
+                .map_err(KeyError::P256Error)?;
+            ecdsa::signature::Verifier::verify(&verifying_key, content, &signature)
+                .map_err(KeyError::ECDSAError)
+        }
+        KeyType::K256Public => {
+            let signature =
+                ecdsa::Signature::from_slice(signature).map_err(KeyError::SignatureError)?;
+            let verifying_key = k256::ecdsa::VerifyingKey::from_sec1_bytes(&key_data.1)
+                .map_err(KeyError::P256Error)?;
+            ecdsa::signature::Verifier::verify(&verifying_key, content, &signature)
+                .map_err(KeyError::ECDSAError)
+        }
+        KeyType::P256Private => {
+            let signature =
+                ecdsa::Signature::from_slice(signature).map_err(KeyError::SignatureError)?;
+            let secret_key: p256::SecretKey =
+                ecdsa::elliptic_curve::SecretKey::from_slice(&key_data.1)
+                    .map_err(KeyError::SecretKeyError)?;
+            let public_key = secret_key.public_key();
+            let verifying_key = p256::ecdsa::VerifyingKey::from(public_key);
+            ecdsa::signature::Verifier::verify(&verifying_key, content, &signature)
+                .map_err(KeyError::ECDSAError)
+        }
+        KeyType::K256Private => {
+            let signature =
+                ecdsa::Signature::from_slice(signature).map_err(KeyError::SignatureError)?;
+            let secret_key: k256::SecretKey =
+                ecdsa::elliptic_curve::SecretKey::from_slice(&key_data.1)
+                    .map_err(KeyError::SecretKeyError)?;
+            let public_key = secret_key.public_key();
+            let verifying_key = k256::ecdsa::VerifyingKey::from(public_key);
+            ecdsa::signature::Verifier::verify(&verifying_key, content, &signature)
+                .map_err(KeyError::ECDSAError)
+        }
+    }
+}
+
+/// Signs content using a private key.
+///
+/// Returns an error if a public key is provided instead of a private key.
+pub fn sign(key_data: &(KeyType, Vec<u8>), content: &[u8]) -> Result<Vec<u8>, KeyError> {
+    match key_data.0 {
+        KeyType::K256Public | KeyType::P256Public => Err(KeyError::PrivateKeyRequiredForSignature),
+        KeyType::P256Private => {
+            let secret_key: p256::SecretKey =
+                ecdsa::elliptic_curve::SecretKey::from_slice(&key_data.1)
+                    .map_err(KeyError::SecretKeyError)?;
+            let signing_key: p256::ecdsa::SigningKey = p256::ecdsa::SigningKey::from(secret_key);
+            let signature: p256::ecdsa::Signature = signing_key
+                .try_sign(content)
+                .map_err(KeyError::ECDSAError)?;
+            Ok(signature.to_vec())
+        }
+        KeyType::K256Private => {
+            let secret_key: k256::SecretKey =
+                ecdsa::elliptic_curve::SecretKey::from_slice(&key_data.1)
+                    .map_err(KeyError::SecretKeyError)?;
+            let signing_key: k256::ecdsa::SigningKey = k256::ecdsa::SigningKey::from(secret_key);
+            let signature: k256::ecdsa::Signature = signing_key
+                .try_sign(content)
+                .map_err(KeyError::ECDSAError)?;
+            Ok(signature.to_vec())
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_identify_key() {
+        assert!(matches!(
+            identify_key("z3vLVqpQveB3w8G6MQsLVseJ1Z2E1JyQzUj6WgRYNNwB9jdE"),
+            Ok((KeyType::K256Private, _))
+        ));
+        assert!(matches!(
+            identify_key("z3vLVqpQveB3w8G6MQsLVseJ1Z2E1JyQzUj6WgRYNNwB9jdE"),
+            Ok((KeyType::K256Private, _))
+        ));
+        assert!(matches!(
+            identify_key("z3vLVqpQveB3w8G6MQsLVseJ1Z2E1JyQzUj6WgRYNNwB9jdE"),
+            Ok((KeyType::K256Private, _))
+        ));
+        assert!(matches!(
+            identify_key("z3vLVqpQveB3w8G6MQsLVseJ1Z2E1JyQzUj6WgRYNNwB9jdE"),
+            Ok((KeyType::K256Private, _))
+        ));
+        assert!(matches!(
+            identify_key("asdasdasd"),
+            Err(KeyError::DecodeError(_))
+        ));
+        assert!(matches!(
+            identify_key("z4vLVqpQveB3w8G6MQsLVseJ1Z2E1JyQzUj6WgRYNNwB9jdE"),
+            Err(KeyError::InvalidKey(_))
+        ));
+    }
+
+    #[test]
+    fn test_sign_p256() -> Result<()> {
+        let private_key = "did:key:z42tnbHmmnhF11nwSnp5kQJbcZQw2Vbw5WF3ABDSxPtDgU2o";
+        let public_key = "did:key:zDnaeXduWbJ1b1Kgjf3uCdCpMDF1LEDizUiyxAxGwerou3Nh2";
+
+        let private_key_data = identify_key(private_key);
+        assert!(matches!(private_key_data, Ok((KeyType::P256Private, _))));
+        let private_key_data = private_key_data.unwrap();
+
+        let public_key_data = identify_key(public_key);
+        assert!(matches!(public_key_data, Ok((KeyType::P256Public, _))));
+        let public_key_data = public_key_data.unwrap();
+
+        let content = "hello world".as_bytes();
+
+        let signature = sign(&private_key_data, content);
+        assert!(signature.is_ok());
+        let signature = signature.unwrap();
+
+        {
+            let validation = validate(&public_key_data, &signature, content);
+            assert!(validation.is_ok());
+        }
+        {
+            let validation = validate(&private_key_data, &signature, content);
+            assert!(validation.is_ok());
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn test_sign_k256() -> Result<()> {
+        let private_key = "did:key:z3vLY4nbXy2rV4Qr65gUtfnSF3A8Be7gmYzUiCX6eo2PR1Rt";
+        let public_key = "did:key:zQ3shNzMp4oaaQ1gQRzCxMGXFrSW3NEM1M9T6KCY9eA7HhyEA";
+
+        let private_key_data = identify_key(private_key);
+        assert!(matches!(private_key_data, Ok((KeyType::K256Private, _))));
+        let private_key_data = private_key_data.unwrap();
+
+        let public_key_data = identify_key(public_key);
+        assert!(matches!(public_key_data, Ok((KeyType::K256Public, _))));
+        let public_key_data = public_key_data.unwrap();
+
+        let content = "hello world".as_bytes();
+
+        let signature = sign(&private_key_data, content);
+        assert!(signature.is_ok());
+        let signature = signature.unwrap();
+
+        {
+            let validation = validate(&public_key_data, &signature, content);
+            assert!(validation.is_ok());
+        }
+        {
+            let validation = validate(&private_key_data, &signature, content);
+            assert!(validation.is_ok());
+        }
+        Ok(())
+    }
+}

src/lib.rs

···
 //! - [`validation`] - Input validation for handles and DIDs
 //! - [`config`] - Configuration management and environment variable handling
 //! - [`errors`] - Structured error types following project conventions
+//! - [`key`] - Cryptographic key operations for P-256 and K-256 curves
 //!
 //! ## Usage
 //!
···
 
 pub mod config;
 pub mod errors;
+pub mod key;
 pub mod model;
 pub mod plc;
 pub mod resolve;

src/model.rs

···
+//! Data structures for DID documents and AT Protocol entities.
+//!
+//! Defines the core data models used throughout the AT Protocol identity system
+//! including DID documents, services, and verification methods. All structures
+//! support JSON serialization/deserialization for working with AT Protocol APIs.
+
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::collections::HashMap;

src/plc.rs

···
 //! The primary function `query()` fetches complete DID documents from PLC directory servers
 //! using HTTPS requests to the standard PLC API endpoint format.
 
-use anyhow::Result;
-
 use super::errors::PLCDIDError;
 use super::model::Document;
 
···
     http_client: &reqwest::Client,
     plc_hostname: &str,
     did: &str,
-) -> Result<Document> {
+) -> Result<Document, PLCDIDError> {
     let url = format!("https://{}/{}", plc_hostname, did);
 
     http_client
···
         .json::<Document>()
         .await
         .map_err(|error| PLCDIDError::DocumentParseFailed { url, error })
-        .map_err(Into::into)
 }

src/validation.rs

···
+//! Input validation for AT Protocol handles and DIDs.
+//!
+//! Provides validation functions for various identifier formats used in the AT Protocol
+//! ecosystem including handles, hostnames, and DID identifiers. Follows RFC standards
+//! for hostname validation and AT Protocol specifications for handle formats.
+
 /// Maximum length for a valid hostname as defined in RFC 1035
 const MAX_HOSTNAME_LENGTH: usize = 253;
 

src/web.rs

···
 //! Transforms DIDs like `did:web:example.com:path:subpath` into HTTPS URLs following
 //! the did:web specification for well-known document locations.
 
-use anyhow::Result;
-
 use super::errors::WebDIDError;
 use super::model::Document;
 
···
 
 /// Queries a did:web DID document from its hosting location.
 /// Resolves the DID to HTTPS URL and fetches the JSON document.
-pub async fn query(http_client: &reqwest::Client, did: &str) -> Result<Document> {
+pub async fn query(http_client: &reqwest::Client, did: &str) -> Result<Document, WebDIDError> {
     let url = did_web_to_url(did)?;
 
     http_client
···
         .json::<Document>()
         .await
         .map_err(|error| WebDIDError::DocumentParseFailed { url, error })
-        .map_err(Into::into)
 }
 
 /// Queries a DID document directly from a hostname's well-known location.
 /// Fetches from https://{hostname}/.well-known/did.json
-pub async fn query_hostname(http_client: &reqwest::Client, hostname: &str) -> Result<Document> {
+pub async fn query_hostname(
+    http_client: &reqwest::Client,
+    hostname: &str,
+) -> Result<Document, WebDIDError> {
     let url = format!("https://{}/.well-known/did.json", hostname);
 
     http_client
···
         .json::<Document>()
         .await
         .map_err(|error| WebDIDError::DocumentParseFailed { url, error })
-        .map_err(Into::into)
 }
 
 #[cfg(test)]