src/crypto/crypto.c and src/session/oauth/dpop.c both suppressed -Wdeprecated-declarations for the legacy EC_KEY/ECDSA API, with a comment tracking the EVP_PKEY migration as separate future work. Does that work now, removing both pragma blocks entirely. - wf_p256_is_low_s / wf_p256_normalize_s now take an EC_GROUP directly (all they ever needed) instead of an EC_KEY. - wf_signing_key_public_didkey's P-256 branch derives the public point via EC_GROUP + EC_POINT_mul with no key object at all, matching the same fix already applied to MetalBear's metalbear_oauth_public_jwk. - wf_signing_key_generate's P-256 branch uses EVP_PKEY_Q_keygen. - wf_sign, wf_verify_internal, and wf_p256_verify_hash (crypto.c) and wf_oauth_dpop_key_generate/_import/_export, wf_oauth_dpop_coordinates, and wf_oauth_es256_sign (dpop.c) now share four helpers exposed via the new src/crypto/crypto_internal.h: wf_p256_pkey_from_private, wf_p256_pkey_from_public_point, wf_p256_sign_hash, and wf_p256_verify_hash_pkey. Both files previously carried independent implementations of the same low-S-normalized raw (r||s) sign/verify logic; per AGENTS.md's no-duplication principle for security-sensitive code, that now exists in exactly one place. Signing builds a DER ECDSA-Sig-Value via EVP_PKEY_sign and decodes it with the (non-deprecated) d2i_ECDSA_SIG for the raw-encoding + low-S rewrite; no ECDSA math is hand-rolled anywhere in this change. Verified before landing: - The old EC_GROUP-derived public-key math is byte-identical to the new code across repeated random keys (same check used for the MetalBear fix). - Full ctest suite: 145/145, including crypto_interop, which verifies the new P-256 verification path against real bluesky-social/atproto reference signature fixtures (message + public key + precomputed signature triples), covering both the valid and non-low-S-rejected cases -- an external correctness oracle, not just self-consistency. - test_dpop and test_client_assertion independently verify JWTs signed by the new dpop.c code with the test suite's own separate ES256 verifier. - Clean build from scratch: zero errors, zero deprecation warnings.