Provision the wrapped scalar with AES-GCM (iv + tag) instead of ECB, so a
tampered/corrupted/wrong-device blob fails at unwrap (AES_GCM_AUTH_E) rather than
yielding a garbage scalar. Matches the wc_Rtl8735b_EccKey iv/tag fields.
The HUK HMAC accumulation buffer now lives on the inner SHA-256 devCtx and relies
on the cryptocb copy/free ops so wc_HmacCopy/wc_HmacFree manage it correctly.
In-memory TLS 1.2 ECDHE-ECDSA handshake with the server certificate ECDSA P-256
signature produced on the HUK HW engine via a PK sign callback. The rest of TLS
(PRF/HMAC, record AES-GCM, ECDHE) stays in software: a whole-CTX WC_HUK_DEVID
would route TLS's own 32-byte HMAC keys (e.g. the P-256 ECDHE pre-master in the
PRF) to the HUK, whose key==seed semantics break key derivation. Validated on
RTL8735B silicon.
David Garske