- Wrapped CNG key casting in try/catch for both public and private key extraction
- RSABCrypt and other non-CNG implementations now gracefully skip key blob export
- Certificate PEM blob still generated correctly (only separate key blobs affected)
- Demoted public key extraction failure from Warning to Verbose (non-critical)
- Added informative message about key implementation type on failure