We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Can load PKCS12 with ED25519 Keys but cannot Serialize them
Why does the pkcs12.serialize_key_and_certificates() still sanitize against ed private keys?  cryptography has no problem loading pkcs12 files which contain ed25519 private keys and related certificates.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `src/cryptography/hazmat/primitives/serialization/pkcs12.py`
Content:
```
1 # This file is dual licensed under the terms of the Apache License, Version
2 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
3 # for complete details.
4 
5 import typing
6 
7 from cryptography import x509
8 from cryptography.hazmat.primitives import serialization
9 from cryptography.hazmat.primitives.asymmetric import (
10     dsa,
11     ec,
12     ed25519,
13     ed448,
14     rsa,
15 )
16 from cryptography.hazmat.primitives.asymmetric.types import (
17     PRIVATE_KEY_TYPES,
18 )
19 
20 
21 _ALLOWED_PKCS12_TYPES = typing.Union[
22     rsa.RSAPrivateKey,
23     dsa.DSAPrivateKey,
24     ec.EllipticCurvePrivateKey,
25 ]
26 
27 
28 class PKCS12Certificate:
29     def __init__(
30         self,
31         cert: x509.Certificate,
32         friendly_name: typing.Optional[bytes],
33     ):
34         if not isinstance(cert, x509.Certificate):
35             raise TypeError("Expecting x509.Certificate object")
36         if friendly_name is not None and not isinstance(friendly_name, bytes):
37             raise TypeError("friendly_name must be bytes or None")
38         self._cert = cert
39         self._friendly_name = friendly_name
40 
41     @property
42     def friendly_name(self) -> typing.Optional[bytes]:
43         return self._friendly_name
44 
45     @property
46     def certificate(self) -> x509.Certificate:
47         return self._cert
48 
49     def __eq__(self, other: object) -> bool:
50         if not isinstance(other, PKCS12Certificate):
51             return NotImplemented
52 
53         return (
54             self.certificate == other.certificate
55             and self.friendly_name == other.friendly_name
56         )
57 
58     def __ne__(self, other: object) -> bool:
59         return not self == other
60 
61     def __hash__(self) -> int:
62         return hash((self.certificate, self.friendly_name))
63 
64     def __repr__(self) -> str:
65         return "<PKCS12Certificate({}, friendly_name={!r})>".format(
66             self.certificate, self.friendly_name
67         )
68 
69 
70 class PKCS12KeyAndCertificates:
71     def __init__(
72         self,
73         key: typing.Optional[PRIVATE_KEY_TYPES],
74         cert: typing.Optional[PKCS12Certificate],
75         additional_certs: typing.List[PKCS12Certificate],
76     ):
77         if key is not None and not isinstance(
78             key,
79             (
80                 rsa.RSAPrivateKey,
81                 dsa.DSAPrivateKey,
82                 ec.EllipticCurvePrivateKey,
83                 ed25519.Ed25519PrivateKey,
84                 ed448.Ed448PrivateKey,
85             ),
86         ):
87             raise TypeError(
88                 "Key must be RSA, DSA, EllipticCurve, ED25519, or ED448"
89                 " private key, or None."
90             )
91         if cert is not None and not isinstance(cert, PKCS12Certificate):
92             raise TypeError("cert must be a PKCS12Certificate object or None")
93         if not all(
94             isinstance(add_cert, PKCS12Certificate)
95             for add_cert in additional_certs
96         ):
97             raise TypeError(
98                 "all values in additional_certs must be PKCS12Certificate"
99                 " objects"
100             )
101         self._key = key
102         self._cert = cert
103         self._additional_certs = additional_certs
104 
105     @property
106     def key(self) -> typing.Optional[PRIVATE_KEY_TYPES]:
107         return self._key
108 
109     @property
110     def cert(self) -> typing.Optional[PKCS12Certificate]:
111         return self._cert
112 
113     @property
114     def additional_certs(self) -> typing.List[PKCS12Certificate]:
115         return self._additional_certs
116 
117     def __eq__(self, other: object) -> bool:
118         if not isinstance(other, PKCS12KeyAndCertificates):
119             return NotImplemented
120 
121         return (
122             self.key == other.key
123             and self.cert == other.cert
124             and self.additional_certs == other.additional_certs
125         )
126 
127     def __ne__(self, other: object) -> bool:
128         return not self == other
129 
130     def __hash__(self) -> int:
131         return hash((self.key, self.cert, tuple(self.additional_certs)))
132 
133     def __repr__(self) -> str:
134         fmt = (
135             "<PKCS12KeyAndCertificates(key={}, cert={}, additional_certs={})>"
136         )
137         return fmt.format(self.key, self.cert, self.additional_certs)
138 
139 
140 def load_key_and_certificates(
141     data: bytes,
142     password: typing.Optional[bytes],
143     backend: typing.Any = None,
144 ) -> typing.Tuple[
145     typing.Optional[PRIVATE_KEY_TYPES],
146     typing.Optional[x509.Certificate],
147     typing.List[x509.Certificate],
148 ]:
149     from cryptography.hazmat.backends.openssl.backend import backend as ossl
150 
151     return ossl.load_key_and_certificates_from_pkcs12(data, password)
152 
153 
154 def load_pkcs12(
155     data: bytes,
156     password: typing.Optional[bytes],
157     backend: typing.Any = None,
158 ) -> PKCS12KeyAndCertificates:
159     from cryptography.hazmat.backends.openssl.backend import backend as ossl
160 
161     return ossl.load_pkcs12(data, password)
162 
163 
164 def serialize_key_and_certificates(
165     name: typing.Optional[bytes],
166     key: typing.Optional[_ALLOWED_PKCS12_TYPES],
167     cert: typing.Optional[x509.Certificate],
168     cas: typing.Optional[typing.Iterable[x509.Certificate]],
169     encryption_algorithm: serialization.KeySerializationEncryption,
170 ) -> bytes:
171     if key is not None and not isinstance(
172         key,
173         (
174             rsa.RSAPrivateKey,
175             dsa.DSAPrivateKey,
176             ec.EllipticCurvePrivateKey,
177         ),
178     ):
179         raise TypeError(
180             "Key must be RSA, DSA, or EllipticCurve private key or None."
181         )
182     if cert is not None and not isinstance(cert, x509.Certificate):
183         raise TypeError("cert must be a certificate or None")
184 
185     if cas is not None:
186         cas = list(cas)
187         if not all(isinstance(val, x509.Certificate) for val in cas):
188             raise TypeError("all values in cas must be certificates")
189 
190     if not isinstance(
191         encryption_algorithm, serialization.KeySerializationEncryption
192     ):
193         raise TypeError(
194             "Key encryption algorithm must be a "
195             "KeySerializationEncryption instance"
196         )
197 
198     if key is None and cert is None and not cas:
199         raise ValueError("You must supply at least one of key, cert, or cas")
200 
201     from cryptography.hazmat.backends.openssl.backend import backend
202 
203     return backend.serialize_key_and_certificates_to_pkcs12(
204         name, key, cert, cas, encryption_algorithm
205     )
206
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/src/cryptography/hazmat/primitives/serialization/pkcs12.py b/src/cryptography/hazmat/primitives/serialization/pkcs12.py
--- a/src/cryptography/hazmat/primitives/serialization/pkcs12.py
+++ b/src/cryptography/hazmat/primitives/serialization/pkcs12.py
@@ -22,6 +22,8 @@
     rsa.RSAPrivateKey,
     dsa.DSAPrivateKey,
     ec.EllipticCurvePrivateKey,
+    ed25519.Ed25519PrivateKey,
+    ed448.Ed448PrivateKey,
 ]
 
 
@@ -174,10 +176,13 @@
             rsa.RSAPrivateKey,
             dsa.DSAPrivateKey,
             ec.EllipticCurvePrivateKey,
+            ed25519.Ed25519PrivateKey,
+            ed448.Ed448PrivateKey,
         ),
     ):
         raise TypeError(
-            "Key must be RSA, DSA, or EllipticCurve private key or None."
+            "Key must be RSA, DSA, EllipticCurve, ED25519, or ED448"
+            " private key, or None."
         )
     if cert is not None and not isinstance(cert, x509.Certificate):
         raise TypeError("cert must be a certificate or None")

{"golden_diff": "diff --git a/src/cryptography/hazmat/primitives/serialization/pkcs12.py b/src/cryptography/hazmat/primitives/serialization/pkcs12.py\n--- a/src/cryptography/hazmat/primitives/serialization/pkcs12.py\n+++ b/src/cryptography/hazmat/primitives/serialization/pkcs12.py\n@@ -22,6 +22,8 @@\n     rsa.RSAPrivateKey,\n     dsa.DSAPrivateKey,\n     ec.EllipticCurvePrivateKey,\n+    ed25519.Ed25519PrivateKey,\n+    ed448.Ed448PrivateKey,\n ]\n \n \n@@ -174,10 +176,13 @@\n             rsa.RSAPrivateKey,\n             dsa.DSAPrivateKey,\n             ec.EllipticCurvePrivateKey,\n+            ed25519.Ed25519PrivateKey,\n+            ed448.Ed448PrivateKey,\n         ),\n     ):\n         raise TypeError(\n-            \"Key must be RSA, DSA, or EllipticCurve private key or None.\"\n+            \"Key must be RSA, DSA, EllipticCurve, ED25519, or ED448\"\n+            \" private key, or None.\"\n         )\n     if cert is not None and not isinstance(cert, x509.Certificate):\n         raise TypeError(\"cert must be a certificate or None\")\n", "issue": "Can load PKCS12 with ED25519 Keys but cannot Serialize them\nWhy does the pkcs12.serialize_key_and_certificates() still sanitize against ed private keys?  cryptography has no problem loading pkcs12 files which contain ed25519 private keys and related certificates.\n", "before_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nimport typing\n\nfrom cryptography import x509\nfrom cryptography.hazmat.primitives import serialization\nfrom cryptography.hazmat.primitives.asymmetric import (\n    dsa,\n    ec,\n    ed25519,\n    ed448,\n    rsa,\n)\nfrom cryptography.hazmat.primitives.asymmetric.types import (\n    PRIVATE_KEY_TYPES,\n)\n\n\n_ALLOWED_PKCS12_TYPES = typing.Union[\n    rsa.RSAPrivateKey,\n    dsa.DSAPrivateKey,\n    ec.EllipticCurvePrivateKey,\n]\n\n\nclass PKCS12Certificate:\n    def __init__(\n        self,\n        cert: x509.Certificate,\n        friendly_name: typing.Optional[bytes],\n    ):\n        if not isinstance(cert, x509.Certificate):\n            raise TypeError(\"Expecting x509.Certificate object\")\n        if friendly_name is not None and not isinstance(friendly_name, bytes):\n            raise TypeError(\"friendly_name must be bytes or None\")\n        self._cert = cert\n        self._friendly_name = friendly_name\n\n    @property\n    def friendly_name(self) -> typing.Optional[bytes]:\n        return self._friendly_name\n\n    @property\n    def certificate(self) -> x509.Certificate:\n        return self._cert\n\n    def __eq__(self, other: object) -> bool:\n        if not isinstance(other, PKCS12Certificate):\n            return NotImplemented\n\n        return (\n            self.certificate == other.certificate\n            and self.friendly_name == other.friendly_name\n        )\n\n    def __ne__(self, other: object) -> bool:\n        return not self == other\n\n    def __hash__(self) -> int:\n        return hash((self.certificate, self.friendly_name))\n\n    def __repr__(self) -> str:\n        return \"<PKCS12Certificate({}, friendly_name={!r})>\".format(\n            self.certificate, self.friendly_name\n        )\n\n\nclass PKCS12KeyAndCertificates:\n    def __init__(\n        self,\n        key: typing.Optional[PRIVATE_KEY_TYPES],\n        cert: typing.Optional[PKCS12Certificate],\n        additional_certs: typing.List[PKCS12Certificate],\n    ):\n        if key is not None and not isinstance(\n            key,\n            (\n                rsa.RSAPrivateKey,\n                dsa.DSAPrivateKey,\n                ec.EllipticCurvePrivateKey,\n                ed25519.Ed25519PrivateKey,\n                ed448.Ed448PrivateKey,\n            ),\n        ):\n            raise TypeError(\n                \"Key must be RSA, DSA, EllipticCurve, ED25519, or ED448\"\n                \" private key, or None.\"\n            )\n        if cert is not None and not isinstance(cert, PKCS12Certificate):\n            raise TypeError(\"cert must be a PKCS12Certificate object or None\")\n        if not all(\n            isinstance(add_cert, PKCS12Certificate)\n            for add_cert in additional_certs\n        ):\n            raise TypeError(\n                \"all values in additional_certs must be PKCS12Certificate\"\n                \" objects\"\n            )\n        self._key = key\n        self._cert = cert\n        self._additional_certs = additional_certs\n\n    @property\n    def key(self) -> typing.Optional[PRIVATE_KEY_TYPES]:\n        return self._key\n\n    @property\n    def cert(self) -> typing.Optional[PKCS12Certificate]:\n        return self._cert\n\n    @property\n    def additional_certs(self) -> typing.List[PKCS12Certificate]:\n        return self._additional_certs\n\n    def __eq__(self, other: object) -> bool:\n        if not isinstance(other, PKCS12KeyAndCertificates):\n            return NotImplemented\n\n        return (\n            self.key == other.key\n            and self.cert == other.cert\n            and self.additional_certs == other.additional_certs\n        )\n\n    def __ne__(self, other: object) -> bool:\n        return not self == other\n\n    def __hash__(self) -> int:\n        return hash((self.key, self.cert, tuple(self.additional_certs)))\n\n    def __repr__(self) -> str:\n        fmt = (\n            \"<PKCS12KeyAndCertificates(key={}, cert={}, additional_certs={})>\"\n        )\n        return fmt.format(self.key, self.cert, self.additional_certs)\n\n\ndef load_key_and_certificates(\n    data: bytes,\n    password: typing.Optional[bytes],\n    backend: typing.Any = None,\n) -> typing.Tuple[\n    typing.Optional[PRIVATE_KEY_TYPES],\n    typing.Optional[x509.Certificate],\n    typing.List[x509.Certificate],\n]:\n    from cryptography.hazmat.backends.openssl.backend import backend as ossl\n\n    return ossl.load_key_and_certificates_from_pkcs12(data, password)\n\n\ndef load_pkcs12(\n    data: bytes,\n    password: typing.Optional[bytes],\n    backend: typing.Any = None,\n) -> PKCS12KeyAndCertificates:\n    from cryptography.hazmat.backends.openssl.backend import backend as ossl\n\n    return ossl.load_pkcs12(data, password)\n\n\ndef serialize_key_and_certificates(\n    name: typing.Optional[bytes],\n    key: typing.Optional[_ALLOWED_PKCS12_TYPES],\n    cert: typing.Optional[x509.Certificate],\n    cas: typing.Optional[typing.Iterable[x509.Certificate]],\n    encryption_algorithm: serialization.KeySerializationEncryption,\n) -> bytes:\n    if key is not None and not isinstance(\n        key,\n        (\n            rsa.RSAPrivateKey,\n            dsa.DSAPrivateKey,\n            ec.EllipticCurvePrivateKey,\n        ),\n    ):\n        raise TypeError(\n            \"Key must be RSA, DSA, or EllipticCurve private key or None.\"\n        )\n    if cert is not None and not isinstance(cert, x509.Certificate):\n        raise TypeError(\"cert must be a certificate or None\")\n\n    if cas is not None:\n        cas = list(cas)\n        if not all(isinstance(val, x509.Certificate) for val in cas):\n            raise TypeError(\"all values in cas must be certificates\")\n\n    if not isinstance(\n        encryption_algorithm, serialization.KeySerializationEncryption\n    ):\n        raise TypeError(\n            \"Key encryption algorithm must be a \"\n            \"KeySerializationEncryption instance\"\n        )\n\n    if key is None and cert is None and not cas:\n        raise ValueError(\"You must supply at least one of key, cert, or cas\")\n\n    from cryptography.hazmat.backends.openssl.backend import backend\n\n    return backend.serialize_key_and_certificates_to_pkcs12(\n        name, key, cert, cas, encryption_algorithm\n    )\n", "path": "src/cryptography/hazmat/primitives/serialization/pkcs12.py"}], "after_files": [{"content": "# This file is dual licensed under the terms of the Apache License, Version\n# 2.0, and the BSD License. See the LICENSE file in the root of this repository\n# for complete details.\n\nimport typing\n\nfrom cryptography import x509\nfrom cryptography.hazmat.primitives import serialization\nfrom cryptography.hazmat.primitives.asymmetric import (\n    dsa,\n    ec,\n    ed25519,\n    ed448,\n    rsa,\n)\nfrom cryptography.hazmat.primitives.asymmetric.types import (\n    PRIVATE_KEY_TYPES,\n)\n\n\n_ALLOWED_PKCS12_TYPES = typing.Union[\n    rsa.RSAPrivateKey,\n    dsa.DSAPrivateKey,\n    ec.EllipticCurvePrivateKey,\n    ed25519.Ed25519PrivateKey,\n    ed448.Ed448PrivateKey,\n]\n\n\nclass PKCS12Certificate:\n    def __init__(\n        self,\n        cert: x509.Certificate,\n        friendly_name: typing.Optional[bytes],\n    ):\n        if not isinstance(cert, x509.Certificate):\n            raise TypeError(\"Expecting x509.Certificate object\")\n        if friendly_name is not None and not isinstance(friendly_name, bytes):\n            raise TypeError(\"friendly_name must be bytes or None\")\n        self._cert = cert\n        self._friendly_name = friendly_name\n\n    @property\n    def friendly_name(self) -> typing.Optional[bytes]:\n        return self._friendly_name\n\n    @property\n    def certificate(self) -> x509.Certificate:\n        return self._cert\n\n    def __eq__(self, other: object) -> bool:\n        if not isinstance(other, PKCS12Certificate):\n            return NotImplemented\n\n        return (\n            self.certificate == other.certificate\n            and self.friendly_name == other.friendly_name\n        )\n\n    def __ne__(self, other: object) -> bool:\n        return not self == other\n\n    def __hash__(self) -> int:\n        return hash((self.certificate, self.friendly_name))\n\n    def __repr__(self) -> str:\n        return \"<PKCS12Certificate({}, friendly_name={!r})>\".format(\n            self.certificate, self.friendly_name\n        )\n\n\nclass PKCS12KeyAndCertificates:\n    def __init__(\n        self,\n        key: typing.Optional[PRIVATE_KEY_TYPES],\n        cert: typing.Optional[PKCS12Certificate],\n        additional_certs: typing.List[PKCS12Certificate],\n    ):\n        if key is not None and not isinstance(\n            key,\n            (\n                rsa.RSAPrivateKey,\n                dsa.DSAPrivateKey,\n                ec.EllipticCurvePrivateKey,\n                ed25519.Ed25519PrivateKey,\n                ed448.Ed448PrivateKey,\n            ),\n        ):\n            raise TypeError(\n                \"Key must be RSA, DSA, EllipticCurve, ED25519, or ED448\"\n                \" private key, or None.\"\n            )\n        if cert is not None and not isinstance(cert, PKCS12Certificate):\n            raise TypeError(\"cert must be a PKCS12Certificate object or None\")\n        if not all(\n            isinstance(add_cert, PKCS12Certificate)\n            for add_cert in additional_certs\n        ):\n            raise TypeError(\n                \"all values in additional_certs must be PKCS12Certificate\"\n                \" objects\"\n            )\n        self._key = key\n        self._cert = cert\n        self._additional_certs = additional_certs\n\n    @property\n    def key(self) -> typing.Optional[PRIVATE_KEY_TYPES]:\n        return self._key\n\n    @property\n    def cert(self) -> typing.Optional[PKCS12Certificate]:\n        return self._cert\n\n    @property\n    def additional_certs(self) -> typing.List[PKCS12Certificate]:\n        return self._additional_certs\n\n    def __eq__(self, other: object) -> bool:\n        if not isinstance(other, PKCS12KeyAndCertificates):\n            return NotImplemented\n\n        return (\n            self.key == other.key\n            and self.cert == other.cert\n            and self.additional_certs == other.additional_certs\n        )\n\n    def __ne__(self, other: object) -> bool:\n        return not self == other\n\n    def __hash__(self) -> int:\n        return hash((self.key, self.cert, tuple(self.additional_certs)))\n\n    def __repr__(self) -> str:\n        fmt = (\n            \"<PKCS12KeyAndCertificates(key={}, cert={}, additional_certs={})>\"\n        )\n        return fmt.format(self.key, self.cert, self.additional_certs)\n\n\ndef load_key_and_certificates(\n    data: bytes,\n    password: typing.Optional[bytes],\n    backend: typing.Any = None,\n) -> typing.Tuple[\n    typing.Optional[PRIVATE_KEY_TYPES],\n    typing.Optional[x509.Certificate],\n    typing.List[x509.Certificate],\n]:\n    from cryptography.hazmat.backends.openssl.backend import backend as ossl\n\n    return ossl.load_key_and_certificates_from_pkcs12(data, password)\n\n\ndef load_pkcs12(\n    data: bytes,\n    password: typing.Optional[bytes],\n    backend: typing.Any = None,\n) -> PKCS12KeyAndCertificates:\n    from cryptography.hazmat.backends.openssl.backend import backend as ossl\n\n    return ossl.load_pkcs12(data, password)\n\n\ndef serialize_key_and_certificates(\n    name: typing.Optional[bytes],\n    key: typing.Optional[_ALLOWED_PKCS12_TYPES],\n    cert: typing.Optional[x509.Certificate],\n    cas: typing.Optional[typing.Iterable[x509.Certificate]],\n    encryption_algorithm: serialization.KeySerializationEncryption,\n) -> bytes:\n    if key is not None and not isinstance(\n        key,\n        (\n            rsa.RSAPrivateKey,\n            dsa.DSAPrivateKey,\n            ec.EllipticCurvePrivateKey,\n            ed25519.Ed25519PrivateKey,\n            ed448.Ed448PrivateKey,\n        ),\n    ):\n        raise TypeError(\n            \"Key must be RSA, DSA, EllipticCurve, ED25519, or ED448\"\n            \" private key, or None.\"\n        )\n    if cert is not None and not isinstance(cert, x509.Certificate):\n        raise TypeError(\"cert must be a certificate or None\")\n\n    if cas is not None:\n        cas = list(cas)\n        if not all(isinstance(val, x509.Certificate) for val in cas):\n            raise TypeError(\"all values in cas must be certificates\")\n\n    if not isinstance(\n        encryption_algorithm, serialization.KeySerializationEncryption\n    ):\n        raise TypeError(\n            \"Key encryption algorithm must be a \"\n            \"KeySerializationEncryption instance\"\n        )\n\n    if key is None and cert is None and not cas:\n        raise ValueError(\"You must supply at least one of key, cert, or cas\")\n\n    from cryptography.hazmat.backends.openssl.backend import backend\n\n    return backend.serialize_key_and_certificates_to_pkcs12(\n        name, key, cert, cas, encryption_algorithm\n    )\n", "path": "src/cryptography/hazmat/primitives/serialization/pkcs12.py"}]}