The FIPS draft for Dilithium signature scheme (official name ML-DSA) had just been released not long ago. In the specification for skDecode (which is the subroutine that loads the private signing key) mentions that this procedure must be performed on trusted input only.
What I want to ask has nothing to do with cryptographic aspect of it, (side-channel mitigation, etc.) rather, if an entity can be convinced into loading an untrusted private key, then its security is presumably disastrously broken.
So the question: is there any reason at all, to load an untrusted private key on a production system? And what attack vector are there against systems that does load untrusted private keys?
I'm asking because I'm considering whether to implement private key checks into my project.
