pub fn generate_keypair() -> WgKeypairExpand description
Generate a fresh WireGuard keypair using the OS CSPRNG.
We fill 32 bytes via rand (the workspace’s rand = 0.10, backed by the OS entropy
source) and build the StaticSecret from them, then derive the public key. This is
equivalent to StaticSecret::random_from_rng(OsRng) but avoids coupling to a specific
rand_core trait version — x25519-dalek 2 speaks rand_core 0.6 while the crate’s
rand is 0.9-era, and the two RNG traits do not unify. Clamping is applied by
x25519-dalek at key-agreement time, exactly as in random_from_rng.