Skey: a FIDO2 security key on the Raspberry Pi Pico

Firmware for the Pico / Pico 2 that acts as a USB FIDO2 authenticator:
CTAP2 and U2F, passkeys, BOOTSEL as the touch button, and clientPIN with
PIN/UV auth protocols 1 and 2. A host simulator runs the same core so the
python-fido2 test suite exercises it without hardware.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

firmware/mbedtls_config.h

@@ -0,0 +1,26 @@
+// mbedtls build configuration for the firmware: SHA-256, HMAC, P-256 ECDSA/ECDH
+// and AES-256-CBC (PIN protocols) only.
+#ifndef SKEY_MBEDTLS_CONFIG_H
+#define SKEY_MBEDTLS_CONFIG_H
+
+#define MBEDTLS_NO_PLATFORM_ENTROPY
+
+#define MBEDTLS_MD_C
+#define MBEDTLS_SHA256_C
+
+#define MBEDTLS_BIGNUM_C
+#define MBEDTLS_ECP_C
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#define MBEDTLS_ECP_NIST_OPTIM
+#define MBEDTLS_ECDSA_C
+#define MBEDTLS_ECDSA_DETERMINISTIC
+#define MBEDTLS_HMAC_DRBG_C
+#define MBEDTLS_ASN1_PARSE_C
+#define MBEDTLS_ASN1_WRITE_C
+
+#define MBEDTLS_AES_C
+#define MBEDTLS_CIPHER_MODE_CBC
+#define MBEDTLS_AES_ROM_TABLES  // keep the lookup tables in flash, not RAM
+#define MBEDTLS_AES_FEWER_TABLES
+
+#endif