- Add tokio::Semaphore for bounded parallelism
- Split benchmark into sequential warmup and parallel measured phases
- Refactor to spawn_benchmark_tasks() and spawn_single_iteration()
- Add write_results() to aggregate and output records
- Use u32 for CLI arguments (iters, warmup, concurrency, payload_bytes)
- Update server and runner to use X25519MLKEM768 kx group from aws_lc_rs
- Both --mode x25519 and --mode x25519mlkem768 now work
- Integration tested end-to-end with both modes
- Generate self-signed certificates on startup using rcgen
- Configure rustls with aws_lc_rs crypto provider
- Filter key exchange groups to X25519-only for mode=x25519
- Print CA certificate for client trust configuration
- TLS 1.3 protocol enforced
- CaCertificate: self-signed CA that can sign server certificates
- ServerCertificate: DER-encoded cert chain and private key
- generate_test_certs(): convenience helper for local testing
- Uses rcgen 0.14 for X.509 certificate generation