feat(casan): establish assurance kernel and harden control plane

infra/local-prod/idp/mock_idp.py

@@ -10,6 +10,7 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlencode, urlparse
 
 import jwt
+from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import rsa
 
 
@@ -33,7 +34,12 @@ USERS = {
     },
 }
 KID = "casan-local-prod-idp"
-KEY = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+KEY_FILE = os.environ.get("CASAN_IDP_PRIVATE_KEY_FILE", "")
+if KEY_FILE:
+    with open(KEY_FILE, "rb") as key_handle:
+        KEY = serialization.load_pem_private_key(key_handle.read(), password=None)
+else:
+    KEY = rsa.generate_private_key(public_exponent=65537, key_size=2048)
 CODES = {}
 APPROVAL_SIGNER_TOKEN = os.environ.get("CASAN_APPROVAL_SIGNER_TOKEN", "")