P-521 signature algorithms require the aws_lc_rs feature even for custom SigningKeys #460

PKCS_ECDSA_P521_SHA256, PKCS_ECDSA_P521_SHA384, and PKCS_ECDSA_P521_SHA512 are behind #[cfg(feature = "aws_lc_rs")] (also on main), and SignatureAlgorithm has no public constructor. So a custom SigningKey built with default-features = false (an HSM, a remote signer, or another crypto backend) cannot return a P-521 algorithm from PublicKeyData::algorithm() without compiling aws-lc-rs, even though rcgen never calls aws-lc-rs for that key.

The gate exists for sign_alg, which only rcgen's own KeyPair reads. One option is to gate the statics on any(feature = "aws_lc_rs", not(feature = "crypto")), so they exist whenever no backend that lacks P-521 is compiled in; another is to make sign_alg optional for algorithms the active backend cannot sign with.

Context: rind-rcgen implements SigningKey on a pure-Rust backend that signs P-521, and builds rcgen without crypto.

(Written by Claude Opus 5.5)