Public and private keys

Think of the public key as a padlock you hand out freely; the private key is the only matching key. Or: the public key is your visible banner; the private key is the seal that proves a message truly came from you.

• Private key — signs messages / decrypts data meant for you. Never leave Mount Doom’s forge unattended. Leak = total compromise.
• Public key — verifies signatures / encrypts to you. Safe to publish, embed in certificates, or derive addresses from.

Formats you will meet: PEM (Base64 + headers), DER (binary), JWK (JSON). Our forge exports PEM and JWK for ECDSA P-256.