Trusted publishing is GitHub-Actions-only, so authentication goes through a crates.io API token stored as the CARGO_REGISTRY_TOKEN secret, scoped to the pkh crate. The job gates on the build job and fails loudly when the tag does not match the version in Cargo.toml, since cargo publish ships the declared version regardless of the tag name.