Add tool to verify host-key documents

Add a tool that can be used to verify if a given IBM host-key document is
valid. This uses the same logic (and code) as the image/request tools
for IBM Secure Execution, pvimg, pvattest, and pvsecret.

This tool basically just does the first step of the above tools; but without
creating any request or image.

Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

rust/pvverify/src/cli.rs

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: MIT
+//
+// Copyright IBM Corp. 2025
+use std::sync::OnceLock;
+
+use clap::{ArgAction, Parser};
+use utils::CertificateOptions;
+
+static VERSION: OnceLock<String> = OnceLock::new();
+
+#[derive(Parser, Debug)]
+#[command(long_version=ver(), disable_version_flag(true))]
+/// Tool to verify host-keys
+///
+/// Tool to verify host-keys. Use this tool to verify the chain of trust for IBM Secure
+pub struct CliOptions {
+    #[command(flatten)]
+    pub certificate_args: CertificateOptions,
+
+    #[arg(long, action=ArgAction::Version)]
+    /// Print version information and exit.
+    version: (),
+}
+
+fn ver() -> &'static str {
+    VERSION.get_or_init(|| utils::tools_version_fmt!(2025))
+}

rust/pvverify/src/main.rs

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: MIT
+//
+// Copyright IBM Corp. 2025
+#![allow(missing_docs)]
+
+mod cli;
+
+use anyhow::Result;
+use clap::Parser;
+use log::{info, LevelFilter};
+use utils::PvLogger;
+
+static LOGGER: PvLogger = PvLogger;
+
+fn main() -> Result<()> {
+    LOGGER.start(LevelFilter::Trace)?;
+    cli::CliOptions::parse()
+        .certificate_args
+        .get_verified_hkds("info")?;
+    info!("Host-key documents verified.");
+    Ok(())
+}