Key ceremony

A key ceremony is how important keys are born: on hardware that has never been on a network, following a written script, with every step recorded. Certificate authorities, payment networks and custodians all use them.

What a good ceremony covers:

• Clean hardware, never connected to a network.
• A written script, followed step by step, with a record of what was done.
• Split backups, for example with Shamir secret sharing, so no one holds the whole key.
• Public outputs, such as public keys, published so others can check what was created.
• Cleanup of everything that touched the secret.

On Valtu

Valtu's production keys were created in an offline key ceremony on 13 October 2026, on a machine that has never been connected to a network. Their public keys are compiled into the enclave image, so its measurement covers them. The backup is split with Shamir secret sharing and held offline.