pub fn decode_public_key(bytes: &[u8]) -> Result<AffinePoint>
Decode a 33-byte SEC1 compressed P-256 point. Public so bindings can verify the DKG-produced joint public key out-of-band.