- Wrapped CNG key casting in try/catch for both public and private key extraction
- RSABCrypt and other non-CNG implementations now gracefully skip key blob export
- Certificate PEM blob still generated correctly (only separate key blobs affected)
- Demoted public key extraction failure from Warning to Verbose (non-critical)
- Added informative message about key implementation type on failure
- Added ExecutionTimeout and ExecutionTimeoutInterval to ssh-keygen calls (2 min timeout)
- Added ExecutionTimeout and ExecutionTimeoutInterval to sshd -t validation (30 sec timeout)
- Fixed firewall profile enumeration: use string array instead of unavailable type
- Profiles now use simple array: @('Domain', 'Private', 'Public')