Private keys live and sign inside certified hardware and never appear in application memory. The owner's authority is defended by silicon, not by software discipline.
A hardware security module is the physical container for the owner's signing authority.
Signing keys are generated by the HSM's internal entropy source and marked non-exportable, so no plaintext private key ever exists outside the module.
The application sends the digest to be signed into the HSM and receives a signature back; the private key never crosses into host memory, disk, or logs.
Physical intrusion, temperature, or voltage attacks trigger the module's tamper response, zeroizing sensitive material before it can be extracted.
ML-DSA-65 signing is anchored in the HSM so the owner's quantum-resistant root benefits from the same hardware isolation as classical keys.
Possession of the module is not possession of the authority to sign.
Bringing a key into a usable state requires a quorum of authorized custodians presenting their factors, so no single administrator can wield the root alone.
Security-officer, custodian, and operator roles are distinct, so the people who administer the module are not the same people who authorize its use.
Each key carries usage policy — permitted operations, quorum, and rate — enforced by the module itself rather than by the calling application.
Signing sessions are authenticated and short-lived, and the module drops back to a locked state so a captured session cannot be replayed indefinitely.
Hardware custody is engineered for availability without compromising isolation.
Signing is served by a cluster of modules so the loss of one unit does not halt issuance, settlement, or weight release.
Modules sit inside sovereign data centers, keeping key material physically within the owner's jurisdiction and residency requirements.
Where keys must exist on more than one module, they are replicated only as wrapped material under the cluster's protection, never as exportable plaintext.
The highest-authority root can be held in an offline module and brought online only for ceremonies, minimizing its exposure surface between uses.
Every signature the platform relies on ultimately originates in a module.
The platform integrates with modules over standard cryptographic interfaces, so owners can bring qualified hardware from their approved vendors.
The service hands the HSM only the hash to be signed, never the private key, keeping the attack surface to a single well-defined call.
Hardware-produced signatures are what get appended to the hash-chained ledger, so the tamper-evident record is rooted in hardware, not host software.
Atomic delivery-versus-payment settlements require signatures from the relevant parties' modules, so no leg of a trade commits without hardware-held consent.
Hardware custody covers the full life of a key, not just its use.
Key creation follows a scripted, witnessed ceremony with recorded quorum, producing an auditable origin for every root.
New keys can be provisioned and certified while old ones remain valid, allowing rotation without breaking in-flight settlement or issuance.
Retiring a key means zeroizing it inside the module and recording the event, so decommissioning is provable rather than assumed.
Module firmware and configuration can be attested so operators can confirm the hardware serving signatures is in a known, approved state.