Design and implement a collaborative threshold CA for mesh via DKG + ZKP to address the single point of trust issue with CA private keys, ensuring genesis-managed CA lifecycle (key generation, storage, signing, rotation) and delegation of `launch mesh init` to genesis CLI.
## Problem `launch mesh init` generates the ML-DSA-87 CA private key as a flat file on the operator's local disk. Single point of trust, architecturally inconsistent with the decentralized design. The CA key holder can mint arbitrary mesh identities. ## Requirements ### Core: genesis-managed CA lifecycle - Genesis manages CA key generation, storage (envelope-encrypted), signing, rotation - Raw CA private key never leaves genesis's trust boundary - `launch mesh init` delegates to genesis CLI instead of running `nebula-cert` directly - `launch mesh add` requests cert signing from genesis (signing happens internally) ### Target: threshold CA via Distributed Key Generation (DKG) - Multiple genesis instances across clusters collaboratively generate a threshold CA key - No single genesis instance ever holds the complete CA private key - k-of-n genesis instances must cooperate to sign a node certificate - Each partial signing verified via zero-knowledge proof (correct key share usage with