STIR/SHAKEN error codes (mpbx-stir-shaken)

Raised by the STIR/SHAKEN settings (PUT /api/v1/trunks/stir-shaken, W10-TRK-01). Messages name the field and the rule, never the private key.

Code	Kind	Meaning	What to do
MPBX-STIR-CONFIG-INVALID	invalid_argument	The certificate chain, private key or x5u URL does not check: not PEM, more than 5 certificates or 64 KiB, a SEC1 key instead of PKCS#8, a key that is not P-256 or does not belong to the first certificate, a certificate that is not valid now, or an x5u URL that is not https. The settings route reports these as a 400 naming the field.	Fix the named field (convert a SEC1 key with openssl pkcs8 -topk8 -nocrypt).
MPBX-STIR-KEY-UNREADABLE	unavailable	The signing key cannot be sealed or opened (no keyring on this server, or a sealed key the master key cannot open). Signing turns off until it is fixed; the server log says why.	Check the install's master key; upload the key again.

A failed inbound verification is not an API error: the call is marked, refused with the RFC 8224 status (436, 437, 438 or 403 Stale Date) or only recorded, as the settings say, and counted in mpbx_trunk_inbound_total{result="stir_failed"} when refused.