Quickstart broken: missing PQC key generation after platform added hybrid key support

[marythought]

Problem

The quickstart (curl -fsSL https://opentdf.io/quickstart/install.sh | bash) fails with:

Error: issue creating opentdf server: security.NewCryptoProvider: failed to read private key file
[/keys/kas-xwing-private.pem]: open /keys/kas-xwing-private.pem: no such file or directory

Root cause

The quickstart docker-compose (docs/getting-started/docker-compose.yaml) does two things that are now out of sync:

1. Downloads opentdf-example.yaml from platform/main (line 339), which since commit opentdf/platform@1209acc2 includes hybrid PQC keyring entries (hpqt:xwing, hpqt:secp256r1-mlkem768, hpqt:secp384r1-mlkem1024) that reference key files like kas-xwing-private.pem

2. Generates keys with an inline generate-keys service (line 467) that only creates RSA and EC keys via openssl — it does not run the Go keygen utility (service/cmd/keygen) that creates the PQC key files

The platform repo's own init-temp-keys.sh was updated in the same commit to call go run ./service/cmd/keygen, but the quickstart's docker-compose uses its own key generation and never runs that script.

Impact

The quickstart is broken for anyone running it against current main. There is no workaround available to someone following the published quickstart steps.

Possible fixes

1. Pin the config download to the latest pre-PQC release tag (e.g. service/v0.15.0) instead of main
2. Add PQC key generation to the generate-keys service in the quickstart docker-compose (would need Go or a container image that includes the keygen binary)
3. Use opentdf-dev.yaml instead of opentdf-example.yaml — the dev config doesn't include PQC keyring entries and works with just RSA + EC keys
4. Ship a pre-built keygen binary in the platform container image so the quickstart can call it without needing a Go toolchain

Option 3 is probably the fastest fix.

Reported by

@eerav.kandikattu via community — needs a quick turnaround.