Released last week was systemd 257-rc1 while succeeding that already is systemd 257-rc2 and it comes with a new tool: systemd-keyutil.
Systemd 257-rc1 introduced expanded Varlink support, MPTCP as a supported socket protocol for socket units, systemd-boot menu support for volume up/down rocker handling, a new systemd-sbsign tool for signing EFI PE binaries, and many other new additions and other changes.
With systemd 257-rc2 there are mostly just fixes and other minor changes over systemd 257-rc1, but there is one new tool included in the form of systemd-keyutil. The systemd-keyutil tool was merged post-RC1 and is for carrying out various key/certificate operations. Generic key/certificate operations are provided by this new systemd-keyutil tool rather than spreading them across various other systemd tools.
The addition of systemd-keyutil addresses this issue raised by Lennart Poettering over re-considering where some commands are placed. Daan De Meyer of Meta managed to implement systemd-keyutil and see it merged this past week.
The systemd 257-rc2 release can be downloaded from GitHub.