Using public key crypto for this seems like overkill. If you're willing to use symmetric crypto, a DESFire EV1 card is probably the way to go, and you can get those off the shelf for a dollar or two. Or, if you want public-key signatures, Yubikey devices can do it.
I'm curious, though: why a gadget that fits on the knob? You can get off-the-shelf electric strikes and off-the-shelf electric fail-secure locks in AC and DC variants quite easily.
Public key crypto is exactly what should be used in this application.
Specifically, symmetric crypto would require exchange of secret material between the keycard and the lock at least once. Whether the lock is telling the keycard what secret to use, or the keycard tells the lock what secret it's using. Both scenarios introduce vulnerabilities if someone is able to listen in on that exchange, and one of those scenarios means the keying material in the keycard needs to be dynamic, which introduces problems.
Public key crypto on the other hand is dead simple, hard to get wrong, and a perfect analogy for this application. To enable a keycard you just have the lock read its public key. To auth, you just verify a signature. No secret material is ever exchanged which means no MITM and the keycards remain static devices which means it's easier to make them unclonable.
RE: DESFire EV1. I don't trust MIFARE. Old habits die hard, and MIFARE has very bad habits. Plus all the above.
> No secret material is ever exchanged which means no MITM
That's a bit of a stretch. A MITM could replace the public key that gets transferred. Admittedly, making it look like enrollment worked is awkward, but there is certainly no cryptographic prevention of a MITM.
I should also point out that, even if you choose to use public key crypto, using digital signatures in particular is not necessarily the right choice. The property you want is authentication, not necessarily a non-repudiable signature. For example, the private key holder could authenticate by decrypting an encrypted challenge or completing a DH exchange.
If you're using Curve25519, doing the DH operation is a bit cheaper and less fiddly than running Ed25519, which is a nice benefit. If you're using P-256, it's a much bigger deal: ECDH on P-256 is much safer than using ECDSA, especially on a limited device, as an ECDSA signature using a poor RNG can negate the security of the entire system.
I'm curious, though: why a gadget that fits on the knob? You can get off-the-shelf electric strikes and off-the-shelf electric fail-secure locks in AC and DC variants quite easily.