A Tezos Remote Signer
Signatory signs your Tezos Ops while protecting your private keys in HSMs, Cloud KMS, or TEEs
Following the Tezos Foundation's decision to end funding for Signatory in January 2026 (and decline a minimal maintenance-only proposal), ECAD Labs has wound down active Tezos protocol maintenance. Four months after our June 2026 announcement, there remains no transition plan or alternative from the core teams for institutional HSM, Cloud KMS, or TEE (tz4/BLS) custody.
To avoid leaving production operators exposed to recent Go stdlib and network vulnerabilities, ECAD Labs published v1.4.1 (October 2026) at our own expense. However, we do not ship untested security claims: v1.4.1 is validated through PtTALLiN (octez-v24.4) and has not been tested by ECAD Labs against the Ushuaia (PsUshuai) protocol. See the Agora thread for context and migration options, or contact [email protected] for commercial support.
Easy to start, trivial to secure
Start by prototyping with an on-disk key; move to HSMs, Cloud KMS, or TEEs when ready.
Protocol‑aware policy enforcement
Set explicit Tezos policies (kinds, requests, JWT, remote policy). Signatory validates requests and watermarks before delegating to your HSM/KMS/TEE.
For bakers, validators, and apps
Use Signatory for baking/validator infrastructure and application workflows alike—such as exchanges, custodians, or oracles. A single signer enforces policy and watermarks while keys remain in your HSM/KMS/TEE.
Modular external policy (callback)
Integrate bespoke controls without forking Signatory using the remote policy hook. Signatory POSTs operation + metadata; your service returns allow/deny (optionally signed). See Remote Policy.
Built with observability
Critical infrastructure monitoring is crucial. Signatory exposes operational metrics for Prometheus allowing teams to monitor operations with the tools they have already invested in.