The root of trust never leaves the owner. Sovex operates the rails; the state holds the keys — and no line of our code can sign in its place.
Zero-custody means the vendor is architecturally incapable of producing a valid signature on the owner's behalf.
Root signing keys are generated inside the owner's own security boundary — their HSM cluster, their facility, their operators. Sovex software provisions the ceremony but is never present at generation.
Sovex holds no copy, escrow, or derivative of any root private key. There is no master key, service key, or maintenance key that shadows the owner's authority.
The absence of a vendor signing path is a structural property, not a policy promise. Signing endpoints require the owner's key handle; there is no alternate code path that bypasses it.
Roots are ML-DSA-65 (FIPS 204) signing keys, so the owner's long-lived authority is designed to survive the transition to quantum-capable adversaries.
Every privileged action resolves to a signature that only the owner can produce.
Clients construct a transaction or weight-release request, the owner's key signs it in their own boundary, and Sovex rails only accept an already-signed, verifiable payload.
The platform's role is to verify signatures against the owner's registered public keys and enforce policy — it never needs the private key to do its job.
Signatures are detached and travel with the object they authorize, so authority can be checked independently of the service that transported it.
Because signing is decoupled from submission, the owner can keep signing capability on an offline or network-isolated tier and move only signed artifacts across the boundary.
For a sovereign CBDC, zero-custody is what makes issuance genuinely non-custodial.
Minting, burning, and monetary-policy operations are authorized by the central bank's root key. Sovex cannot create or destroy value on the ledger without a signature it cannot forge.
Every signed monetary action is appended to a tamper-evident, hash-chained ledger, binding the owner's signature to an immutable position in history.
The central bank can issue subordinate keys for day-to-day operations while retaining the root that certifies them, so operational convenience never dilutes ultimate control.
Delegated authority is expressed as owner-signed certificates with explicit scope and expiry, and can be revoked by the root without touching the underlying rails.
Owners hold the keys and the weights; releasing a model is a signing event.
Foundation and specialized model checkpoints are sealed and released only under the owner's signature, so the nation controls which weights ever leave the training enclave.
Key generation, signing, and weight storage all remain inside sovereign infrastructure, keeping the entire chain of authority within the owner's jurisdiction.
There is no vendor path to extract, copy, or re-license weights, because every access-granting action must resolve to the owner's key.
Signed release records tie a specific weight artifact to the training run and approving authority, giving the owner an auditable lineage for every deployed model.
The design is meant to be inspected, not trusted on faith.
The code paths that consume owner signatures are scoped and reviewable, so an auditor can confirm there is no parallel route that admits vendor authority.
The set of public keys the platform will honor is administered by the owner, so no third party can inject a key that would be accepted as legitimate.
The custody boundary and its enforcement are part of the production-hardening and independent audit now in progress across the engines.
Any request lacking a valid owner signature is rejected rather than degraded to a lesser check, so the default outcome of ambiguity is no authority granted.