feat: add ECDSA keystore support for enhanced security

[solethus]

Summary

This PR implements ECDSA keystore support to address the security concerns raised in issue #16. The current approach of using raw private keys in environment variables exposes sensitive cryptographic material, creating security risks for node operators.

Related Issue

Closes #16

Changes Made

Core Infrastructure

• Added ECDSA keystore loader utility (src/utils/ecdsa_loader.go)
  • LoadECDSAKey() function with keystore file support and environment variable fallback
  • GetECDSAKeystoreFlags() for consistent flag definitions across commands
  • Backward compatibility with existing environment variables

Updated Commands

• ARPA commands (bin/avs-cli/arpa/arpa.go)
  • register-node - supports both PRIVATE_KEY env var and keystore files
  • generate-registration-signature - supports both ADMIN_1271_SIGNING_KEY env var and keystore files
• Update ECDSA signer (bin/avs-cli/update_ecdsa_signer.go)
  • Supports PRIVATE_KEY env var and keystore files
• Witness chain (bin/avs-cli/witness-chain/prepareRegistration.go)
  • Supports WATCHTOWER_PRIVATE_KEY env var and keystore files

New Command Line Flags

All updated commands now support:

• --ecdsa-keystore - Path to encrypted keystore file
• --ecdsa-password - Password for keystore file

Testing

• Comprehensive ECDSA keystore tests (src/keystore/keystore_test.go)
  • Valid/invalid password testing
  • Nonexistent file error handling
  • Address verification
• LoadECDSAKey utility tests (src/utils/ecdsa_loader_test.go)
  • Keystore file loading
  • Environment variable fallback
  • Error condition coverage
  • Interface mocking for testability

Documentation

• Updated README.md with comprehensive ECDSA key management guide
  • Keystore file usage examples
  • Environment variable legacy support
  • Step-by-step migration guide
  • Security benefits explanation
• Updated sample.env with deprecation notices and new approach examples

Migration Path

For Node Operators (Recommended)

# 1. Create keystore from existing private key
eigenlayer operator keys import --key-type ecdsa [keyname] [private_key_hex]

# 2. Use keystore flags instead of environment variables
./avs-cli arpa register-node \
  --operator-id 1 \
  --dkg-public-key "0x..." \
  --registration-signature input.json \
  --ecdsa-keystore /path/to/keystore.json \
  --ecdsa-password "your_password"

Backward Compatibility (Legacy)

Existing workflows using environment variables continue to work unchanged:

export PRIVATE_KEY="your_private_key_hex"
./avs-cli arpa register-node --operator-id 1 --dkg-public-key "0x..." --registration-signature input.json

Testing

• All existing tests pass
• New ECDSA keystore tests pass
• LoadECDSAKey utility tests pass
• Build compilation successful
• Backward compatibility verified
• Keystore file loading verified
• Error handling tested

Security Improvements

• No raw private keys in environment variables - Keystore files are encrypted with password protection
• Industry standard compatibility - Uses EigenLayer CLI keystore format that operators are already familiar with
• Better operational security - Reduces risk of key exposure in process environments and logs
• Gradual migration - Operators can migrate at their own pace while maintaining existing workflows

Breaking Changes

None. This PR maintains full backward compatibility with existing environment variable usage.