CA / KEY CUSTODY
Your key.
Your proof.
An account key proves that a request came from you. It is separate from your password and from the keys inside your certificates.
On your device
A private seed creates your ML-DSA key. Signing runs in a local worker.
PRIVATEIn your backup
Your passphrase encrypts the seed. Save the file, then prove you can unlock it.
ENCRYPTEDAt the authority
Only your public key and an enrollment proof are sent. Certificate permission is checked separately.
PUBLIC KEY + PROOFPrepare your account key
Checking key-enrollment availability and your account access…
Start with a recoverable key
Download encrypted backupUnlock your saved file
Already have a backup for this account and authority? Restore it here. Your backup stays on this device.
Local key verified
Public-key fingerprint
Enrollment registers this account key. It does not validate a domain or issue a certificate.
Create and restore are paused while this key is loaded. If an enrollment response is interrupted, retry with this key. To use a different key, clear the local key first.