signing keys

Federation signing keys

Every credential BBSL issues is cryptographically signed by one of these keys. Verifiers fetch the public half from the registry; the private half stays in the hardware security module. Rotate on a 12-month cadence (or immediately if compromised) — old keys are retired, never destroyed, so historic credentials still verify.