NativeCertGen.kt provides CertGenConfig data class and JNI bridge to libcertgen.so. KeyMintSecurityLevelInterceptor.doSoftwareKeyGen() tries native path first, falls back to BouncyCastle on failure or when library unavailable. App.kt loads libcertgen.so at daemon start.