Use the windows crate for the TPM key

A failure to open the TPM fell back to a software key, which minted a new CA
and kept it for good. Fail instead, as macOS does without a Secure Enclave.

core/src/mitm/ca.rs

@@ -1,5 +1,4 @@
 use rama::error::BoxError;
-use rama::tls::boring::core::sha::sha256;
 use rama::tls::boring::core::x509::X509;
 use rcgen::{
     BasicConstraints, CertificateParams, CertificateRevocationListParams, DistinguishedName,
@@ -40,12 +39,6 @@ impl CertificateAuthority {
         (held == signer.subject_public_key_info()).then_some(ca)
     }
 
-    /// Unique to this CA, so a verifier's cached CRL from an earlier one never applies to it.
-    pub fn crl_path(&self) -> String {
-        let digest = sha256(self.pem.as_bytes());
-        format!("/{}.crl", digest[..8].iter().map(|b| format!("{b:02x}")).collect::<String>())
-    }
-
     fn new(pem: String) -> Result<Self, BoxError> {
         Ok(Self { crt: X509::from_pem(pem.as_bytes())?, pem })
     }

core/tests/mitm.rs

@@ -50,12 +50,3 @@ fn ca_signs_an_empty_crl() {
     let crl = mitm::crl(&["registry.npmjs.org", "pypi.org"], &signer()).expect("sign a crl");
     assert_eq!(crl[0], 0x30, "a DER SEQUENCE");
 }
-
-/// A re-minted CA must not inherit the old one's CRL from a verifier's cache.
-#[test]
-fn each_ca_names_its_own_crl() {
-    let signer = signer();
-    let npm = mitm::CertificateAuthority::generate(&["registry.npmjs.org"], &signer).expect("mint a ca");
-    let pypi = mitm::CertificateAuthority::generate(&["pypi.org"], &signer).expect("mint a ca");
-    assert_ne!(npm.crl_path(), pypi.crl_path());
-}