For encryption, a secret key is included in the domain data (using declareSecret, or an equivalent write), and is required to decrypt all operations on the domain. The secret can only be obtained by joining the domain, which in turn requires that the requester is registered as a principal in the domain.

Registering a principal requires that the user has a public/private key pair. The public key is registered in the domain using registerPrincipal (or an equivalent write), e.g.

const aliceKeys = generateKeyPairSync('rsa', {
  modulusLength: 2048,
  publicKeyEncoding: { type: 'spki', format: 'der' },
  privateKeyEncoding: { type: 'pkcs1', format: 'pem' }
});
await clone.write(MeldAclTransportSecurity.registerPrincipal(
  'https://alice.example/profile#me', aliceKeys.publicKey));

To use transport security, every local clone in the access-controlled domain must be initialised with the following members of the MeldApp:

• An instance of this class as the transportSecurity member. (This extension cannot be loaded dynamically because transport security must be available before the clone can connect to the domain.)
• An AppPrincipal object as the principal, that represents the current logged-in user. This object will sign data using RSASSA-PKCS1-v1_5 on the extension's request. E.g.:

sign = (data: Buffer) => createSign('RSA-SHA256')
  .update(data).sign(privateKey);

experimental