pub fn hex_encode(bytes: &[u8]) -> String
Lowercase hex encoding, shared by grant signing and key persistence.