Key Guardian

The Key Guardian protects private keys that control digital assets. It routes each signing request to the configured signer backend.

Supported signer backends are local signing, DFNS, Fireblocks, and Luna HSM partition signing.

Secret managers provide underlying key or PIN storage for the local and Luna backends. Secret managers are not a separate signing backend.

Local signing loads the private key inside the local signer process. DFNS, Fireblocks, and Luna keep signing inside their provider or hardware controls.

Key Guardian sits behind the Transaction Signer, which requests signatures for DALP workflows. For the full transaction path from policy checks to custody signing and broadcast, see Signing Flow.

Signer backend hierarchy

Security architecture

The Guardian API receives signature requests without exposing raw key material. The storage router directs each request to the configured signer backend. The local backend reads encrypted private keys from the configured secret provider, and the Luna backend reads PIN material and optional client key references from the same secret-provider layer.

Key lifecycle

• Generation: HSM-backed keys generate entirely within hardware. Software keys use cryptographically secure random sources with immediate encryption before memory clearing.
• Rotation: Replaces active signing keys while maintaining historical keys for verification. Coordinates with blockchain address updates and registry notifications.
• Recovery: Enterprise deployments use sharded backups with threshold signature schemes requiring multiple custodians.
• Revocation: Compromised keys are immediately removed from active use. Smart contract permissions update to reject signatures from revoked keys.

DFNS integration

DFNS provides delegated MPC custody as a pluggable backend.

• Policy enforcement: DFNS policy approvals remain provider-owned. See DFNS policy enforcement for the canonical status vocabulary, error handling, and approval handoff, and Signing Flow for interaction details.
• Multi-party approval model: DFNS policy approvals are separate from DALP smart-wallet multisig approvals, which use a UserOperation approval flow instead of a custody-policy decision flow.
• Audit evidence split: DALP records signing workflow state, transaction identifiers, provider status, and operator activity. DFNS keeps the provider audit trail for custody-policy decisions in the DFNS control plane, so treat the two records as complementary evidence.

Fireblocks integration

Fireblocks provides MPC custody through vault accounts. Switching between DFNS and Fireblocks keeps DALP signing requests consistent, while provider-specific approval and wallet behavior remains behind the signer adapter.

• Vault model: Keys organized into vault accounts, each containing one or more asset wallets. DALP supports creating, listing, and managing vaults.
• Transaction signing: All signing happens through Fireblocks MPC. No single private key ever exists. Fireblocks supports message signing, transaction signing with fee estimation, and typed data signing.
• Transaction Authorization Policy (TAP): Enforces amount thresholds, whitelisted destinations, velocity limits, and multi-approver requirements.
• Approval limitation: Fireblocks approval remains provider-owned and is resolved through the Fireblocks Console or a Co-Signer appliance. See Fireblocks TAP behavior for the canonical polling and approval flow.

Luna HSM integration

Luna HSM provides hardware-backed signing through a configured Thales Luna 7 partition. DALP keeps the signer interface consistent with the other backends, while quorum activation remains outside DALP.

• Partition signing: The Luna adapter signs EVM transactions, messages, typed data, and raw 32-byte digests through PKCS#11.
• Scoped wallet labels: Luna wallet labels encode the organization and system scope so a signer cannot use a wallet outside the calling scope.
• M-of-N quorum activation: When the partition is waiting for quorum activation, DALP records a pending provider state and resumes after the out-of-band Luna control process activates the partition.

Comparing custody providers

Access control and audit

• Only Transaction Signer components can request signatures
• Signature requests require valid workflow context
• Rate limiting prevents bulk signature extraction
• All access attempts log for security review

See also

• Transaction Signer for signature operations
• Custody Providers for DFNS, Fireblocks, and Luna HSM provider behaviour
• Signing Flow for the end-to-end transaction signing sequence