support new wolfHSM multi-root-CA verification

[bigbrett]

• Updates the wolfHSM certificate verification to use the new multi-root API and allow user to specify a list of root CA NVM IDs for verification. This enables signing images with different chains corresponding to different roots without requiring a firmware update to wolfBoot.
• Updates wolfHSM to latest

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates wolfBoot’s wolfHSM-based certificate chain verification to support the new multi-root API, allowing verification against a configurable list of trusted root CA NVM IDs, and bumps the wolfHSM submodule.

Changes:

• Switch certificate verification calls to wolfHSM “MultiRoot” APIs (DMA / non-DMA, client / server).
• Replace single root CA NVM ID HAL export with a root CA list + count.
• Update docs and bump the wolfHSM submodule revision.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/image.c	Uses wolfHSM MultiRoot verification APIs and passes root list + count.
include/hal.h	Updates HAL interface to expose root CA list + count instead of a single ID.
hal/sim.c	Provides default root CA list/count and a build-time override macro for simulator.
hal/aurix_tc3xx.c	Provides default root CA list/count and a build-time override macro for AURIX.
docs/wolfHSM.md	Documents multi-root provisioning and new HAL exports / build-time override.
lib/wolfHSM	Updates wolfHSM submodule pointer to a newer commit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #776

Scan targets checked: wolfboot-bugs, wolfboot-src

No new issues found in the changed files. ✅