By default, the platform never holds owner keys. Signing authority stays with the asset owner, and settlement executes against signatures the platform can verify but never produce.
The default posture separates asset control from platform operation so the operator can move records but never move value on its own authority.
Private signing material is generated and retained in the owner's environment. The platform ingests public keys and verification metadata only, and has no code path that can reconstruct or export a private key.
The platform sequences, validates, and records transactions, but every state transition that transfers an asset requires a signature the operator cannot generate. Compromise of the operator yields no ability to move owner assets.
Custody is expressed as who can authorize a transition, not who stores the token. Ownership is enforced by signature verification at settlement rather than by an account balance the platform could unilaterally edit.
Custodial and HSM-backed arrangements exist as explicit opt-ins for institutions that require them. Absent that election, no component of the platform is authorized to sign on an owner's behalf.
Signing uses lattice-based schemes selected for long-lived sovereign assets whose control must survive a transition to quantum-capable adversaries.
Owner authorizations are produced with ML-DSA-65 (FIPS 204). Verification keys and signatures are carried in the transaction record so any auditor can independently confirm that a transition was authorized by the stated key.
Each signed payload binds the asset identifier, the intended counterparty, the nonce, and the settlement context. A signature captured in one context cannot be replayed to authorize a different transfer.
The signature, the public key, and the signed digest are recorded alongside the ledger entry. Authorization is reconstructable after the fact without trusting the operator's assertion that a transfer was approved.
Signature schemes are referenced by identifier in the record, allowing new post-quantum primitives to be introduced without invalidating history. Old entries remain verifiable under the scheme that signed them.
A trade either completes with both legs signed and committed together, or it does not commit at all — there is no window in which the platform holds one side.
Asset delivery and payment settle as a single indivisible transition. Both owners' signatures are collected before commit, and the ledger applies both legs or neither.
Because settlement is atomic against owner signatures, the platform never sits in the middle holding an asset pending the other leg. There is no intermediate custodial balance to seize, freeze, or misappropriate.
Signed authorizations can encode the exact counterparty, price, and expiry the owner intends. The commit is rejected if the presented settlement does not match the terms the owner signed over.
A missing or invalid signature aborts the transition cleanly and leaves prior state untouched. Failed settlement produces a recorded rejection rather than a partial or ambiguous transfer.
Non-custodial control is only credible if the history of authorizations cannot be silently rewritten by the operator.
Each entry commits to the prior entry's hash, so any alteration to a past authorization breaks the chain from that point forward and is detectable by independent verification.
The ledger and its keys of record remain within the owning jurisdiction's infrastructure. Custody arrangements never require asset control data to leave national boundaries.
An auditor with the public keys and the chain can reconstruct that every transfer was authorized and correctly ordered, without privileged access to platform internals.
The platform's role is to order and attest transitions. Its records prove what owners authorized; they never constitute an independent claim on the underlying asset.