Signing-key management

The distribution account's seed is the most sensitive thing in a deployment. All key access is isolated behind one port so the seed never has to live in the application process.

interface ExternalSigner {
  readonly publicKey: string; // G…
  sign(data: Uint8Array): Promise<Uint8Array>; // ed25519 over the tx hash
}

Environment	Signer	Where the seed lives
Local / testnet	LocalKeypairSigner	In process — throwaway testnet keys only
Production	A KMS/HSM-backed ExternalSigner	In the vault; never in the app

A KMS/HSM that supports ed25519 implements ExternalSigner by delegating sign to the vault, so the application only ever sees the public key and a finished signature. Rotate keys on a schedule; because callers depend on the port, rotation is a config change, not a code change.