DER Serialized Public Key Loader

If you've got a .der public key file sitting next to a signed message and you want to check that signature in ComfyUI, this is the node that gets you from raw bytes to something you can actually verify against. DERPublicKey is the "DER Serialized Public Key Loader," a dumb little adapter, and it exists because of a mismatch most people hit on day one with this pack: the verify nodes (ECVerify, EdDSAVerify) want a KEYOBJ, not a pile of bytes. This node is the bridge.

What it actually does

load_der_public_key() is the whole trick, via Python's cryptography library. You hand it the DER-encoded bytes of a public key - the binary format you get from openssl rsa -pubout -outform DER or from another ARG Toolkit node's DER encoding - and it parses them into the pack's KEYOBJ type, which carries the parsed key object around the graph. One input, one output, nothing else to misconfigure.

The same idea is mirrored by its siblings in serialization.py: PEMPublicKey, DERPrivateKey, PEMPrivateKey. DER is just the compact binary cousin of the base64-looking PEM format. If your keyfile starts with -----BEGIN PUBLIC KEY-----, that's PEM and you want the PEM loader instead. If it's a blob of binary that your file manager would call "data," it's probably DER.

What to feed it

• keyfile (BYTESLIKE): the DER bytes. You can't just paste text into this - the ARG Toolkit defines its own BYTESLIKE type, so you need something upstream that emits it. The simplest path is a ByteslikeEncode node, or read the file in with a loader that produces bytes. If you generated the key with ECPrivateKey/ECPublicKey set to DER encoding, wire that node's keyfile/public_bytes straight in - that works too.

• loaded_key (KEYOBJ, output): plug this into the public_key input of ECVerify or EdDSAVerify, or into the serialized_key inputs of the other key nodes in the pack.

Installing it

It ships inside the ComfyUI ARG Toolkit, so there's nothing extra to grab:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit
# restart ComfyUI

Or skip the terminal and search "ComfyUI ARG Toolkit" in ComfyUI Manager's install tab. Manager pulls the pip dependencies (cryptography, secretpy, stegano, invisible-watermark, reedsolo) for you.

Where people get burned

• Type mismatch. KEYOBJ and BYTESLIKE are the pack's own types - a plain ComfyUI string won't connect to keyfile. This is the #1 confusion with the whole pack, and the fix is to route everything through the pack's own converters.
• Encrypted or wrong-format keys. This loader expects an unencrypted public key in DER. Feed it PEM and you get a parse error, not a graceful "try the other node." That's the pack's testing philosophy in a nutshell: it covers the happy path, and it's not shy about it in the README.
• It's a loader, not a verifier. Loading succeeds even if the key is "wrong." The actual yes/no happens downstream in the verify node, so don't expect this one to tell you anything about whether a signature matches.

For a beginner just trying to close the loop on a signing workflow, DERPublicKey is the node you'll reach for less often than the PEM version - most ARG material floating around uses the base64 PEM form. But when you're handed DER bytes, you'll be glad it exists, because there is no other clean way to get them into a KEYOBJ.