rmcp 3.1.4 requires 32-byte signing keys for MRTR request state and stops Debug from printing OAuth secrets

The official Rust SDK released rmcp 3.1.4 on 2026-08-20 with a hardening change to the code that signs Multi Round-Trip Request state. No advisory was filed for it.

RequestStateCodec protects the opaque requestState values that carry MRTR continuations with an HMAC signing key. Pull request #1166 states its constructor accepted keys of any length even though the documentation recommended at least 32 bytes of high-entropy material, which made it easy for an integration to configure weak key material without noticing. The fix makes the secure path the explicit one: try_new now requires at least 32 bytes, the legacy new is deprecated as of 3.1.4, and new_unchecked remains for callers that validate keys elsewhere.

Two credential-hygiene problems were fixed in the same change. Stored request-state key bytes were kept in memory without being zeroized when dropped, and the derived Debug implementation on ClientCredentialsConfig could print OAuth client secrets and private signing keys, which is the kind of exposure that reaches logs rather than attackers directly. Request-state keys are now zeroized and credential Debug output redacts its secret fields. The pull request records no breaking changes.

The release carries two other fixes. Elicitation now preserves the $schema dialect declared in a requestedSchema rather than normalizing it away, and errors in pre-initialization metadata are reported instead of being swallowed. Version 3.1.3, published 2026-08-17, preceded it.