pub fn fingerprint_pubkey_raw(pubkey_raw: &[u8]) -> String
base64 SHA-256 of raw pubkey bytes; matches CP’s expected_pubkey_fingerprint field on the bootstrap token.
expected_pubkey_fingerprint