feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

backend/fleet/src/Fleet.Hosting/Hosting.cs

@@ -331,6 +331,15 @@ public sealed class LoadedNodeIdentity : IDisposable
 
     public X509Certificate2 Certificate { get; }
 
+    /// <summary>
+    /// 对等面的签名身份：TLS 证书的那把密钥，和连服务端用的 <see cref="Identity"/> 是两把独立的密钥，
+    /// 各自只用于自己的用途（一把泄露不影响另一把）。
+    /// </summary>
+    public NodeIdentity PeerIdentity => _peerIdentity ??= NodeIdentity.FromPkcs8(
+        (Certificate.GetECDsaPrivateKey() ?? throw new InvalidDataException("the node certificate has no ECDSA private key")).ExportPkcs8PrivateKey());
+
+    private NodeIdentity? _peerIdentity;
+
     public static LoadedNodeIdentity Load(string directory)
     {
         if (!System.IO.File.Exists(Path.Combine(directory, KeyFileName)) || !System.IO.File.Exists(Path.Combine(directory, TlsFileName)))
@@ -347,6 +356,7 @@ public sealed class LoadedNodeIdentity : IDisposable
     public void Dispose()
     {
         Identity.Dispose();
+        _peerIdentity?.Dispose();
         Certificate.Dispose();
     }
 }