feat: add packet signature policy schema

Author: RCGV1

meshtastic/config.proto

@@ -1286,6 +1286,28 @@ message Config {
   }
 
   message SecurityConfig {
+    /*
+     * Controls how the device authenticates remotely received mesh packets.
+     */
+    enum PacketSignaturePolicy {
+      /*
+       * Prefer authenticated packets while retaining compatibility with unsigned packets from nodes not known to sign.
+       * This is the default and rejects unsigned, signable packets from nodes that have previously signed.
+       */
+      PACKET_SIGNATURE_POLICY_BALANCED = 0;
+
+      /*
+       * Accept unsigned packets for maximum compatibility while still rejecting malformed or invalid signatures.
+       */
+      PACKET_SIGNATURE_POLICY_COMPATIBLE = 1;
+
+      /*
+       * Accept only packets authenticated by a verified XEdDSA signature or successful PKI decryption.
+       * Unsigned, malformed, invalid, or unverifiable packets are ignored.
+       */
+      PACKET_SIGNATURE_POLICY_STRICT = 2;
+    }
+
     /*
      * The public key of the user's device.
      * Sent out to other nodes on the mesh to allow them to compute a shared secret key.
@@ -1324,6 +1346,11 @@ message Config {
      * Allow incoming device control over the insecure legacy admin channel.
      */
     bool admin_channel_enabled = 8;
+
+    /*
+     * Determines the packet signature policy applied to remotely received mesh packets.
+     */
+    PacketSignaturePolicy packet_signature_policy = 9;
   }
 
   /*

meshtastic/mesh.proto

@@ -2762,6 +2762,12 @@ message DeviceMetadata {
    * (bitwise OR of ExcludedModules)
    */
   uint32 excluded_modules = 12;
+
+  /*
+   * Indicates whether this firmware build includes XEdDSA packet signature verification.
+   * This is a read-only capability and must be false when XEdDSA is not compiled in.
+   */
+  bool has_xeddsa = 14;
 }
 
 /*