Adding dot1x support

docs/TODO.md

@@ -620,6 +620,17 @@ smoke test.
 
 - **Re-enable 802.1X/MACsec:** `disable_dot1x=false` (CI `DISABLE_DOT1X="false"`).
   Removes `rd.dot1x=0`/`ip=dhcp`; the hook owns the link (macsec0).
+  - **Bench harness scaffolded 2026-06-22: [serving/dot1x-bench/](../serving/dot1x-bench/).**
+    step-ca (fleet CA, on the serving host) signs each host's **TPM-generated CSR**
+    + issues the RADIUS server cert; FreeRADIUS does EAP-TLS (trusts step-ca root,
+    returns MSK); a `hostapd` wired authenticator does 802.1X + MACsec on an
+    **isolated bridge per workstation** (flat VLAN can't auth — EAPOL dropped +
+    MACsec is P2P). `enrol/tpm-provision.sh` creates the key in the TPM at
+    `0x81010001` + writes the cert to NV `0x01800001`. Starting solution **signs a
+    CSR** (key stays in TPM); **TPM attestation** (ACME `device-attest-01`) is the
+    documented upgrade on the same CA. **BENCH-VERIFY** items flagged in the files:
+    hostapd MACsec build, openssl tpm2 provider vs pkcs11 key ref, EAP-TLS version.
+    PKI product decision (greenfield): start step-ca; OpenBao/EJBCA/Dogtag later.
 - **NVMe discovery by DNS:** `nvmet_traddr=nvme.fleet.lab` (CI), resolved at boot
   by the serving dnsmasq — drop the hardcoded `192.168.50.10`.
 - **Signing — SIGNED-UKI + SECURE-BOOT-ON PATH BENCH-VERIFIED on the Proxmox VM