Reviewed 16 of 16 files at r1.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @oncilla)

go/lib/scrypto/trc/v2/primary.go, line 292 at r1 (raw file):

		return []byte(s), nil
	}
	return nil, common.NewBasicError(ErrInvalidKeyType, nil, "key_type", int(t))

Use serrors.WithCtx

go/tools/scion-pki/internal/v2/trcs/sign.go, line 31 at r1 (raw file):

type signatureGen struct {
	Dirs    pkicmn.Dirs

hm why doesn't that just embed loader? or did you deliberately chose it like this?

go/tools/scion-pki/internal/v2/trcs/sign_test.go, line 64 at r1 (raw file):

			isdDir := filepath.Join(tmpDir, "ISD1")
			require.NoError(t, os.MkdirAll(isdDir, 0777))
			err := exec.Command("cp", "-r",

ugh, too bad there is no lib function for this :/

Reviewable status: complete! all files reviewed, all discussions resolved

go/lib/scrypto/trc/v2/primary.go, line 292 at r1 (raw file):

I would rather have it consistent in the file and resolve this in a separate PR.

go/tools/scion-pki/internal/v2/trcs/sign.go, line 31 at r1 (raw file):

Loader will have additional capability that should not be "inherited" by the signatureGen

go/tools/scion-pki/internal/v2/trcs/sign_test.go, line 64 at r1 (raw file):

yes. :sad-panda: