This is a useful functionality, but the API is very C-like. Getting the length with &mut [] looks odd:

buffer.resize(pk.raw_public_key(&mut [])?, 0);
let len = pk.raw_public_key(&mut buffer)?;
let key = &buffer[..len];

Since we don't already have a great consistency, I suggest improving the approach further.

If you add raw_public_key_len(), and make the raw_public_key() require a non-empty buffer and return the slice trimmed to the correct length:

fn raw_public_key<'buf>(&self, buf: &'buf mut [u8]) -> Result<&'buf [u8], ErrorStack> {
    …
    Ok(&buf[..size])
}

then the API becomes nicer to use:

let key = pk.raw_public_key(&mut buffer)?; // assuming we know the size

and:

buffer.resize(pk.raw_public_key_len()?, 0);
let key = pk.raw_public_key(&mut buffer)?;

I've explored different variations like Result<Either<&[u8], usize>, ErrorStack> or Result<&[u8], Result<usize, ErrorStack>>, or taking a closure that configures a buffer when needed, but having a separate raw_public_key_len method ends up being the simplest.

Done! I didn't include an explicit check for a non-empty buffer because BoringSSL should already do that—an empty buffer is just a special case of a too-short buffer.

Now I'm wondering, should the input be of type &mut [MaybeUninit<u8>]? Or do we not care about that? Any opinion @kornelski?

Keys are small. MaybeUninit would be an overkill.