feat(security): enforce packet authenticity policies

variants/stm32/CDEBYTE_E77-MBL/platformio.ini

@@ -16,5 +16,8 @@ build_flags =
   -DMESHTASTIC_EXCLUDE_AIR_QUALITY_SENSOR=1
   -DMESHTASTIC_EXCLUDE_I2C=1
   -DMESHTASTIC_EXCLUDE_GPS=1
+build_unflags =
+  ${arduino_base.build_unflags}
+  -DMESHTASTIC_EXCLUDE_XEDDSA=1
 
-upload_port = stlink
+upload_port = stlink

variants/stm32/rak3172/platformio.ini

@@ -15,5 +15,8 @@ build_flags =
   -DMESHTASTIC_EXCLUDE_AIR_QUALITY_SENSOR=1
   -DMESHTASTIC_EXCLUDE_I2C=1
   -DMESHTASTIC_EXCLUDE_GPS=1
+build_unflags =
+  ${arduino_base.build_unflags}
+  -DMESHTASTIC_EXCLUDE_XEDDSA=1
 
 upload_port = stlink

variants/stm32/stm32.ini

@@ -25,7 +25,7 @@ build_flags =
   -DMESHTASTIC_EXCLUDE_BLUETOOTH=1
   -DMESHTASTIC_EXCLUDE_WIFI=1
   -DMESHTASTIC_EXCLUDE_TZ=1 ; Exclude TZ to save some flash space.
-  -DMESHTASTIC_EXCLUDE_XEDDSA=1 ; The Ed25519 signing code does not fit in the 256KB flash. Packets are sent unsigned, like pre-XEdDSA firmware.
+  -DMESHTASTIC_EXCLUDE_XEDDSA=1 ; Individual STM32WL variants opt in after size validation.
   -DSERIAL_RX_BUFFER_SIZE=256 ; For GPS - the default of 64 is too small.
   -DHAS_SCREEN=0 ; Always disable screen for STM32, it is not supported.
   ;-DPIO_FRAMEWORK_ARDUINO_NANOLIB_FLOAT_PRINTF ; Enable this if enabling debugg logging. It is REQUIRED for at least traceroute debug prints - without it the length returned by printf ends up uninitialized.
@@ -61,4 +61,4 @@ lib_ignore =
   OneButton
 
 ; Set a custom linker script with a higher MinStackSize value, to match NRF52.
-board_build.ldscript = $PROJECT_DIR/variants/stm32/stm32wle5xx.ld
+board_build.ldscript = $PROJECT_DIR/variants/stm32/stm32wle5xx.ld