HSM Signing with Turnkey
Generate private keys and sign transactions in your own hardware security module (HSM), while Turnkey handles authentication, policy enforcement, and transaction management.
Today, we're introducing HSM Signing, giving banks, payment companies, custodians, and other institutions a way to generate and host their signing keys in their own hardware security module (HSM) while using Turnkey for authentication, policy enforcement, and transaction management.
Every onchain transaction requires a private key to authorize it. By default, Turnkey protects these keys inside secure enclaves, which are isolated-hardware environments that Turnkey operates. This protects keys without requiring teams to manage any signing hardware.
Some companies, however, have security or regulatory requirements that call for private keys generated and hosted in hardware they own and operate. HSM Signing gives them that option while also leveraging Turnkey's existing features.
What is an HSM?
An HSM, or hardware security module, is a tamper-resistant device designed to generate, store, and use cryptographic keys. HSMs can be certified against security standards such as FIPS 140-3 and are widely used in banking, payments, and digital asset custody.
As mentioned, Turnkey's default infrastructure uses secure enclaves rather than HSMs. Like an HSM, an enclave is isolated hardware, but it runs Turnkey's policy checks alongside key generation and signing, and it can prove exactly which code is running.
An HSM protects private keys, but it doesn't determine who should be allowed to use them. It typically relies on shared credentials rather than understanding individual users or the transactions they're authorized to sign.
Turnkey provides that authorization layer, checking users, permissions, and policies before a signing request reaches the HSM.
Why companies generate and host signing keys in their own HSM
Depending on the business, regulators, auditors, and internal security policies may require that the keys controlling customer assets are generated and hosted in certified hardware operated by the company itself.
Signing with your own HSM is a well-established, regulator-recognized pattern for meeting those expectations. HSM Signing also gives companies direct control over their signing infrastructure.
- You control the HSM. Your team configures the hardware and manages its administrator credentials.
- Your keys stay in your hardware. Keys are generated inside your HSM and never leave it unencrypted.
- You can revoke Turnkey's access. Disconnect Turnkey from your HSM at any time without coordinating with us. Your keys remain available for use through your own systems.
- Turnkey never connects into your infrastructure. Your systems initiate outbound connections to retrieve signing requests from Turnkey. Turnkey does not initiate inbound connections.
This gives teams control over their hardware, keys, and access while continuing to use Turnkey's infrastructure for authorization, policy enforcement, and transaction management.
How HSM Signing works
HSM Signing uses the External Signer Daemon, a software component provided and updated by Turnkey that runs in your infrastructure alongside your HSM.
Each transaction follows four steps:
- Turnkey authorizes the request. Turnkey verifies the requester's identity and checks the transaction against your configured policies.
- Your Daemon retrieves the request. The External Signer Daemon collects the approved request from Turnkey and verifies that it came from Turnkey.
- Your HSM signs. The HSM signs the transaction using the private key, which never exists unencrypted outside it, and returns only the signature.
- Turnkey receives the signature. Your Daemon sends the signature back. Turnkey verifies its origin and, when applicable, broadcasts the transaction to the network.
The private key never leaves your HSM unencrypted. Turnkey handles authorization and receives the signature, but never accesses the private key.
What stays the same when you sign with your own HSM
HSM Signing changes where transactions are signed, not how teams use Turnkey.
Existing features, including users, logins, policies, sub-organizations, and activity history, continue to work as before. Transaction Management still builds, broadcasts, and tracks transactions.
Teams retain one place to manage access and permissions. Only the signing operation moves to their own hardware.
Built to grow with your business
Teams can start with a single External Signer Daemon and HSM, then expand as transaction volume increases.
- Add redundancy. Backup HSMs can take over if a primary HSM becomes unavailable.
- Increase capacity. Additional External Signer Daemons can process more signing requests in parallel.
- Prevent duplicate results. If a signing request is processed more than once, Turnkey accepts only the first result.
HSM Signing is designed to work with HSMs that support PKCS#11, a widely used standard for communicating with cryptographic hardware.
This includes cloud services such as AWS CloudHSM, Google Cloud HSM, and Azure Managed HSM, as well as on-premises devices such as Thales Luna and Entrust nShield.
How responsibilities split between your company and Turnkey
HSM Signing separates responsibility for key storage and hardware operations from transaction authorization and management.
| Your company | Turnkey |
|---|---|
| Configures the HSM and manages administrator credentials | Verifies requests against users and policies |
| Operates the HSM and maintains its firmware | Provides and updates the External Signer Daemon |
| Backs up the HSM and encrypted keys | Backs up organization settings |
| Maintains the HSM's audit logs | Records every request in a queryable activity log |
| Monitors signing operations from the HSM side | Monitors signing operations from Turnkey's side |
Built for institutions
HSM Signing is designed for banks, payment companies, custodians, and other institutions.
It also supports teams whose auditors or internal security requirements mandate that signing keys be generated and hosted in certified hardware under their control.
HSM Signing joins Turnkey's enclave signing and client-side signing as a third signing option. Teams can choose where their keys live based on their operational, security, and compliance requirements.
For organizations that need direct control of their signing hardware, HSM Signing keeps keys where they need to be while Turnkey manages access, policies, and transaction delivery.
Getting started with HSM Signing
Setting up HSM Signing involves configuring your HSM within your infrastructure and registering it with your Turnkey organization.
Our team can help you through the setup and integration process.
Read the docs to learn more, or contact our team to discuss your HSM and compliance requirements.
.png)