MessageSigner

Certifies a party's per-session protocol key with a stable identity key.

At the start of every protocol run — key generation, signing, refresh, and the rest — the SDK mints a fresh, ephemeral message-signing key for the session and asks this signer to vouch for it: sign receives the ephemeral key's public bytes, and the resulting signature binds that per-session key to this party's long-lived identity. Peers verify the binding against verifyingKey. The SDK never handles the identity key itself.

This authenticates the parties to each other; it is separate from, and must not be confused with, the threshold signature the session ultimately produces over the user's message.

Implementations are expected to be backed by a non-exportable key held in a hardware-isolated store — the Android Keystore, the Apple Secure Enclave, or an equivalent module. The crypto modules ship reference signers for testing; production integrations provide their own.

The identity key is independent of the threshold curve. A session that produces secp256k1 ECDSA signatures may still authenticate with an Ed25519 identity key: keyType describes the identity key, never the session output.

Implementations must be safe to invoke from a coroutine on an arbitrary dispatcher. sign is allowed to suspend while a hardware module prompts the user or performs the operation.