0.2.0

• Handshake.split_raw: extract the two raw 32-byte transport keys from a finished handshake, for driving a custom transport like WireGuard's explicit-nonce data channel instead of Transport. Shares the extracted-once semantics of Transport.of_handshake.
• Handshake.remote_static: read the peer's static public key once the handshake reveals it, so a responder can map a connection to a known peer or account.
• Documented the CSPRNG requirement, the absence of key zeroization, and the need for constant-time comparison of handshake_hash / remote_static.
• New ik_custom_transport example: an IK handshake with peer identification and a hand-rolled explicit-nonce, reordering-tolerant transport over the raw keys.
• Reject a PSK modifier whose index exceeds the pattern's message count like XXpsk4 instead of silently dropping the PSK.
• Validate the length of ?rs / ?re public keys at handshake creation rather than mixing a malformed key into the transcript.