Windows `ED25519` Unsupported Algorithm

Description

When attempting to verify an ED25519 certificate on Windows, the verification fails with an "Invalid algorithm specified" error, despite ED25519 being listed in the supported verification schemes.

Code to Reproduce

use rustls::client::danger::ServerCertVerifier;
use rustls_platform_verifier::Verifier;
use std::sync::Arc;

const SERVER_NAME: &str = "my-test";

fn main() {
    let certificate = generate_certificate();

    let crypto_provider = Arc::new(rustls::crypto::aws_lc_rs::default_provider());
    let verifier = Verifier::new(crypto_provider).unwrap();

    println!(
        "Supported schemes: {:?}",
        verifier.supported_verify_schemes()
    );

    let result = verifier.verify_server_cert(
        &certificate,
        &[],
        &SERVER_NAME.try_into().unwrap(),
        &[],
        rustls::pki_types::UnixTime::now(),
    );

    println!("Verify result: {result:?}");
}

fn generate_certificate() -> rustls::pki_types::CertificateDer<'static> {
    let key_pair = rcgen::KeyPair::generate_for(&rcgen::PKCS_ED25519).unwrap();

    let cert = rcgen::CertificateParams::new(vec![SERVER_NAME.to_string()])
        .unwrap()
        .self_signed(&key_pair)
        .unwrap();

    cert.der().to_owned()
}

Output

$ cargo run --example mytest

Supported schemes: [ECDSA_NISTP384_SHA384, ECDSA_NISTP256_SHA256, ECDSA_NISTP521_SHA512, ED25519, RSA_PSS_SHA512, RSA_PSS_SHA384, RSA_PSS_SHA256, RSA_PKCS1_SHA512, RSA_PKCS1_SHA384, RSA_PKCS1_SHA256]
Verify result: Err(General("Invalid algorithm specified. (os error -2146893816)"))

Current Behavior

• ED25519 is listed in supported_verify_schemes()
• Verification fails with error: General("Invalid algorithm specified. (os error -2146893816)")
• The error seems to occur during chain construction (CertGetCertificateChain)

Additional Notes

• The result is the same with both ring and aws-lc-rs backend.
• This failure is specific for Windows operative system

Questions

• Is ED25519 actually supported on Windows?
• If not, should it be removed from supported_verify_schemes()?

Start with the provided Windows reproducer and compare the schemes reported by supported_verify_schemes() with the failure from CertGetCertificateChain. Investigate whether Windows supports ED25519 certificate verification in this path, including both ring and aws-lc-rs backends. Done means the reported support matches actual verification behavior, with coverage or clear documentation for the Windows case.