Mode 4 — Keyless Threshold
Combines Confium’s threshold signing with the Sigstore keyless pattern. No persistent keys, no share management, no key rotation. Every signing ceremony generates a fresh ephemeral threshold keyset.
How it works
- Each signer authenticates via OIDC (GitHub Actions, Google, Okta).
- Coordinator runs ephemeral DKG across N ephemeral public keys.
- Fulcio-style CA issues a short-lived cert binding OIDC identities to the joint ephemeral key.
- T-of-N signers threshold-sign the artifact.
- Cert + signature anchored to the transparency log.
- All ephemeral keys destroyed.
What the verifier sees
The verifier gets:
- A standard ECDSA-P256 signature (verifies in any RFC 3279 verifier).
- A Fulcio-issued short-lived X.509 cert containing the OIDC identities.
- A transparency log inclusion proof.
The trust decision: “this release was signed by a T-of-N quorum of these specific OIDC-verified maintainers at this specific time.”
Comparison with Modes 1–3
| Property | Modes 1–3 | Mode 4 |
|---|---|---|
| Persistent keys | Yes | No |
| Share management | Required | None |
| Identity-bound | No | Yes (OIDC) |
| Long-term archival | Possible | No (cert expires) |
| Operational cost | Medium–High | Low |
When to use Mode 4
- CI/CD release pipelines
- Package publishing (npm, PyPI, RubyGems)
- Anywhere “signed by these N people” beats “signed by key 0xABC”