Key custody

Lab (ns1)

• Config Ed25519: /opt/pfc/etc/sm-keys/config.ed25519.pem (0600). Rotate with rotate_config_key.py (re-sign + admin-history).

• NPE: npe keygen --out /opt/pfc/etc/npe/lab then npe keygen --rotate --id .... Inbox id stays stable.

• Bus PSK: /opt/pfc/etc/nats.env (PFC_NATS_KEY). Not git.

Production

Customer HSM / PKCS#11 for Ed25519 signatures and NPE seed. Private material never in git or world-readable files.

This is not a HIPAA/SOC 2/ISO certificate.