Use .NET 11 AES Key Wrap for RFC 3394 interoperability, enforce key-size and integrity checks, and design KEK rotation before production.
Enable CheckSdkVulnerabilities in .NET 11 CI, enforce NETSDK1238, NETSDK1239, and NETSDK1240, and avoid cache and global.json blind spots.
Configure .NET 11 SignalR authentication refresh to rotate tokens without reconnecting, block identity switches, and test expiry and failure paths.
