Protecting the signing pipeline is mandatory. Forged votes or equivocation can slash stake when slashing adapters are live.

1. Core cryptographic separation

Key File (conventional) Role
Identity validator-keypair.json Gossip / non-consensus identity
Vote signer vote-account-keypair.json Signs votes; isolate or remote-sign
Authorized withdrawer authorized-withdrawer-keypair.json Ultimate authority — offline forever

2. Dual-key / BLS mechanics (Roadmap)

When CLRTY activates BLS-style vote hardening:

  1. Aggregated signature validation
  2. Hardened double-signing protection

Roadmap CLI sketch (not Live)

clrty-keygen new --keypair-type bls12381 -o ~/validator-bls-keypair.json
clrty-keygen pubkey ~/validator-bls-keypair.json
clrty vote-account set-bls-public-key \
  --vote-account ~/vote-account-keypair.json \
  --bls-public-key <GENERATED_BLS_PUBKEY> \
  --fee-payer ~/validator-keypair.json

Do not claim these as Live until CLI release notes say so.

3. Remote signers & HSMs

+-----------------------------------+             +----------------------------------+
|      Validator Node (Online)      |             |     Secure Key Vault / HSM       |
|  - Tracks ledger forks            |  (gRPC/SSH) |  - Holds BLS & Ed25519 private   |
|  - Assembles vote transactions    | ----------->|    keys                          |
|  - Requests signature over network|             |  - Enforces anti-double-signing  |
+-----------------------------------+             +----------------------------------+

Online process must not store vote private keys. Signer daemon tracks signed slots and blocks conflicting hashes for the same slot.

4. Live today

clrtynet wallet status --json
clrtynet node register --dry-run --json

Document custody in Contribution / BRS notes.

Checklist