Function jekt_public_key_for 

fn jekt_public_key_for(agent_id: &str) -> String

The agent’s published public key, or empty if unavailable.

Deliberately a load, never an ensure/mint: registry writes happen on every registration and re-registration, and minting key material as a side effect of a bookkeeping write would be a surprising place to put it. Key creation stays where it already is, at config-injection time (agent_config::inject_jekt_signing_keys_into_mcp_json).