[RuiNelson]

Summary

Rewrites Documentation/CryptographicUtils.md from top to bottom, organized around four tasks:

1. Generating key pairs: choosing an algorithm for SSH, encoding private and public keys, saving key files with 0600 permissions, and Codable storage.
2. Deriving public keys from private keys: the ssh-keygen -y equivalent, the formats and OpenSSH ciphers PrivateKey(string:passphrase:) reads, passphrase handling, and derivePublicKey(from:).
3. Validating existing key pairs: "valid" vs. "accepted by SSH", private and public key checks, per-algorithm checks, checking that a private and a public key belong together (new), reading the rejection reason from AsymmetricCryptographyError (new), and the PrivateKeyString / PrivateKeyFile / SSHUserKeyAlgorithm checks.
4. Validating host key entries: full known_hosts lines vs. shorthand keys and how they map to HostKeyAcceptance, accepted algorithms, what is verified, and the accepted host field forms.

A closing Reference section lists the algorithms, formats, the full error table, the deprecated API, and what these APIs do not check.

README.md and Documentation/UserGuide.md links now point to the new anchors.

Corrections to the old text

• The old text presented TCPLocation.isValidKnownHostsHostField(_:) and knownHostsHost as public API, but both are internal. The new text describes the accepted host field forms instead.
• Full known_hosts lines may end with a comment. The old text described them as exactly three fields.
• Added OpenSSH's rule that an RSA public exponent must be above 1.

Notes for reviewers

• isValid_ShortHandHostKey requires exactly two fields, while HostKeyAcceptance.shortHandAcceptedKeys documents an optional [comment]. This PR documents the current behavior and leaves the code alone.
• The doc comment on AsymmetricKeyType.isAvailable still mentions "bundled Apple XCFrameworks" and a "system OpenSSL on Linux", which no longer matches the source-built OpenSSL. It is not changed here.
• A temporary Swift Testing suite exercised the code samples against the public API (import SwiftSFTP, not @testable) and passed on macOS. That suite is not part of this PR.

Documentation-only change; no source files are modified.

🤖 Generated with Claude Code