fix: validate algorithm parameter in PKI methods

TODO.md

@@ -12,11 +12,11 @@ Unstructured intake buffer for ideas, issues, and observations. Items here are r
 - Webhook notifications for paste events
 - Certificate renewal reminder in CLI
 - Admin endpoint for CA key rotation
-- Shell completions (bash, zsh, fish)
 - Clipboard integration (pbcopy/xclip)
 
 ## Observations
 
+- Shell completions already implemented (`fpaste completion --shell bash/zsh/fish`)
 - Mypy type errors fixed: now enforced in CI (was informational)
 - CI enhanced: security-tests job, SBOM generation (CycloneDX), memory leak checks
 - Comprehensive pentest plan completed (PENTEST_PLAN.md) - all remediations implemented

app/pki.py

@@ -310,6 +310,10 @@ class PKI:
         if self.has_ca():
             raise CAExistsError("CA already exists")
 
+        # Validate algorithm (only EC supported for now)
+        if algorithm != "ec":
+            raise PKIError(f"Unsupported algorithm: {algorithm} (only 'ec' supported)")
+
         # Generate EC key
         curves = {
             "secp256r1": ec.SECP256R1(),
@@ -532,6 +536,10 @@ class PKI:
         if days is None:
             days = self.cert_days
 
+        # Validate algorithm (only EC supported for now)
+        if algorithm != "ec":
+            raise PKIError(f"Unsupported algorithm: {algorithm} (only 'ec' supported)")
+
         ca_key, ca_cert = self._get_signing_key()
         assert self._ca_store is not None  # narrowing for mypy (validated in _get_signing_key)