fixes #12132 -- implement ssh public key fingerprints

[alex]

No description provided.

[alex]

(This was mostly developed by claude-code, but eventually I got bored of baby sitting it and so I just cleaned it up myself)

[alex]

Two choices I made here:

1. I do not include the algorithm name as a prefix
2. For hex, I do not separate the characters by :

My theory was that adding those by a caller is easy-ish, but undoing them is annoying. But I'm not wedded to this.

[alex]

an alternative here would be to just compute the hash, no serialization at all.

[Copilot]

Copilot reviewed 3 out of 5 changed files in this pull request and generated no comments.

Files not reviewed (2)

• CHANGELOG.rst: Language not supported
• docs/hazmat/primitives/asymmetric/serialization.rst: Language not supported

[reaperhulk]

Does the SSH spec define the md5 fingerprint as hex encoded and sha256 as base64 with no padding? If so, can we put that in a comment somewhere? 😄

Assuming that is a documented property of these fingerprints then I think it's fine to do it for the caller rather than presenting back raw digest bytes.

[alex]

So, I'm not aware of a spec for this, I based this on the behavior of ssh-keygen -l with each hash, and a review of the OpenSSH source code. The more I think about this, the more I want to just do raw hash bytes, ala Certificate.fingerprint(). Do you disagree?

[reaperhulk]

Yeah if it's just a current implementation detail I'd rather just do digest bytes with examples of how to encode it to match current ssh-keygen behavior.