Confium Threshold
Eliminate single points of failure in your signing infrastructure.
Use cases
Threshold signatures replace single-key custody with T-of-N quorum signing. The use cases below are the patterns we see most often in production deployments.
HSM Replacement
Replace a single-key HSM with T-of-N distributed signing. No single party can sign alone; compromising T-1 parties does not compromise the key.
Threshold CA Signing
Operate a certificate authority where the root key is split across multiple parties. Issue certifies requires T-of-N quorum.
Automated Key Rotation
Run Herzberg share refresh on a schedule so that compromising the same T parties over time still does not reveal the key.
Sovereign PKI
Operate a national or industry PKI where the root of trust is held by a quorum of institutional parties rather than a single operator.
CI/CD Signing
Sign build artifacts at release time using threshold keys held outside CI. Compromising CI does not compromise the signing key.
Kubernetes Operator Deployment
Run Confium signerd as a Kubernetes operator with declarative share management, automated failover, and graceful shutdown.
Monitoring & Alerting
Wire signerd into Prometheus/Grafana. Alert on signing-op failures, slow rounds, share-recovery events.
Policy Enforcement
Define attribute-based policies that signing sessions must satisfy (geography, role, time-of-day).
OCSP / CRL from Threshold Keys
Operate OCSP responders and CRL signing from threshold keys. No single party can revoke or attest alone.
Bridge Signing
Operate a cross-chain bridge where the signing key is held by a threshold quorum of validators.
Atomic Swaps (Adaptor Signatures)
Use adaptor signatures to construct atomic cross-chain swaps without trusted escrow.
MPC DKG
Run distributed key generation across N parties so that no party ever holds the full key.
Threshold Custody
Custody digital assets under T-of-N quorum control. Withdrawals require threshold sign-off.