demo keys — for demonstration purposes only.

This directory ships pre-generated BGV keypairs per key_id, so demo mode skips keygen.
Layout (the engine contract's key store, read by implicant.crypto.demo_keys):

  demo_keys/<key_id>/secret_key.bin
  demo_keys/<key_id>/manifest.json            {"key_id", "engine_id", "created_at", "public": [names]}
  demo_keys/<key_id>/public/public_key.bin    the public key only (no relin or Galois keys)

SECURITY: the secret keys here are PUBLIC (anyone with the package has them).
Data encrypted in demo mode is therefore NOT private. Never use demo mode for
real data.

Demo mode never uploads keys: a prediction works only once the platform holds the full public
material of its key_id (public, relin and Galois keys). scripts/generate_demo_keys.py writes that
material to the git-ignored demo_handoff/ directory; registering it on the platform is the owner's
step. The script refuses to overwrite an existing key: regenerating a key means registering its
new public material again.
