Function jwk_thumbprint 

fn jwk_thumbprint(alg: &str, pub_bytes: &[u8]) -> String

RFC 7638 JWK thumbprint of the AKP public key: base64url(SHA-256(canonical JSON of the required members alg, kty, pub, in lexicographic order)). pub_bytes is the composite public key ML-DSA-65 pk ‖ ed25519 pk (matching the JWK pub member); all member values are ASCII, so the canonical JSON needs no escaping. This value is the JWK kid. AKP key type and required members per RFC 9964 §6.