Function sign_wan_jekt 

pub fn sign_wan_jekt(
    private_key: &[u8],
    msgid: &str,
    source_agent: &str,
    source_host: &str,
    source_channel: &str,
    target_agent: &str,
    ts_secs: i64,
    message: &str,
) -> Option<String>

Sign a jekt with the sending agent’s own WAN private key (read from its AGENTMUX_WAN_KEY process env var, client-side inside agentmux-mcp, never server-side — same placement as sign_lan_jekt).

private_key must be exactly 32 bytes (the seed generate_wan_keypair produced); any other length returns None rather than panicking, matching the “a missing or malformed key must never block sending” policy every other signer here follows.