Notes on MPC custody for a settlement network

Custody for a settlement network has an unusual requirement: the keys must be usable fast enough to settle inside a window, but no single machine or operator may ever hold a usable key. That rules out hot wallets and most HSM-only designs.

Threshold signatures + a policy engine

We split keys into shares with a threshold scheme and gate every signing request through a policy engine that runs before any share participates: allow-lists, per-asset limits, quorum, time-locks. The policy is enforced server-side and on-chain, never in the client. Shares live in HSMs that partners can run on their own infrastructure.

The hard part is not the cryptography — it is the operational lifecycle: rotation, recovery, and making the policy engine legible to a compliance team. More on that as we approach mainnet.