[panavenue]

Summary

Aligns key serialization with GoogleCloudPlatform/alloydb-python-connector#547, verifies and continuously tests hybrid Post-Quantum Cryptography (PQC) TLS 1.3 key exchange (X25519MLKEM768) on OpenSSL 3.5+, and documents PQC runtime requirements in README.md.

ConnectionInfo.create_ssl_context() already enforces ssl.TLSVersion.TLSv1_3 (when supported by OpenSSL) without restricting key-exchange groups, so Python runtimes linked against OpenSSL 3.5+ automatically offer and negotiate X25519MLKEM768 (0x11ec).

Changes

• google/cloud/sql/connector/utils.py & tests/: Switch generate_keys() private key serialization from legacy PKCS#1 (TraditionalOpenSSL) to modern algorithm-agnostic PKCS8 (-----BEGIN PRIVATE KEY-----), matching GoogleCloudPlatform/alloydb-python-connector#547, while preserving full backwards compatibility with existing RSA keys and SSLContext.load_cert_chain. Update tests/conftest.py and tests/unit/mocks.py (CertificatePublicKeyTypes) accordingly.
• tests/unit/test_pqc.py & tests/unit/test_utils.py:
  • Verify generate_keys() emits PKCS#8 private keys and SubjectPublicKeyInfo public keys.
  • Verify ConnectionInfo.create_ssl_context() completes real TLS 1.3 mTLS handshakes with modern PKCS#8 RSA keys, legacy PKCS#1 RSA keys, and ECDSA PKCS#8 keys.
  • Verify real TLS 1.3 mTLS handshakes advertise and negotiate X25519MLKEM768 (0x11ec) by default on OpenSSL 3.5+, fall back cleanly to classical ECDHE (secp256r1 / 0x0017 via HelloRetryRequest) against classical-only servers, and honor client-side OPENSSL_CONF Groups opt-out.
• .github/workflows/tests.yml: Add unit-pqc CI job running nox -s unit-3.13 inside a digest-pinned python:3.13-trixie container (OpenSSL 3.5+), since ubuntu-latest (24.04) ships OpenSSL 3.0.x.
• README.md: Add a Post-Quantum Cryptography (PQC) section covering automatic X25519MLKEM768 negotiation on OpenSSL 3.5+, checking ssl.OPENSSL_VERSION, classical fallback compatibility, and OPENSSL_CONF opt-out caveats.