Kiln has published the hosting and recovery arrangements behind Ledger Wallet’s Canton integration. Its October 26 account describes two separately operated validators checking transactions, alongside a recovery plan agreed before the service carried user funds.
This explains an existing service. Ledger introduced Canton Coin support on August 19, letting users create accounts, hold CC and send or receive it with a Ledger signer. The new detail is how the infrastructure behind those accounts operates.
A transfer needs both operators
Keeping a signing key on a hardware device answers one question: who can authorise a transfer? Canton also needs infrastructure to check that the proposed transaction is valid and keep the relevant account records.
In this deployment, Ledger operates one validator and Kiln the other. Both host the same wallets. Kiln’s announcement says both must confirm each transaction.
The roles are separate:
- The user signs. Ledger says the user reviews and authorises the transfer on the hardware signer, where their private keys remain.
- The two validators check it. Both operators must confirm it before the transaction can complete.
Canton calls hosting the same identity on several participant nodes multi-hosting. The required number of confirmations is its threshold. Here, that means two confirmations from two validators.
Reading a balance is different from moving funds
Two copies do not mean either operator can complete a transfer alone. Kiln says balance reads can switch between the validators if one is unavailable. A transaction still needs both.
- Checking a balance: the other validator can provide the read if one is unavailable.
- Completing a transfer: both validators need to be available to confirm it.
This is an operational trade-off: the arrangement shares transaction checking between two operators, while making transfers dependent on both being online.
Deployment model described in Kiln’s October 26 account. The recovery shares protect validator infrastructure keys, separate from the user’s hardware signer. Recovery is an agreed process, with no uninterrupted-service or recovery-time guarantee established here.
Recovery uses a separate two-of-three rule
Kiln describes creating the validator’s three identity keys on an air-gapped machine, meaning one isolated from network connections. The keys were encrypted under a master key. That master key was split into three recovery shares, with any two needed to reconstruct it.
These are infrastructure recovery shares, separate from the user’s hardware signing key. They also serve a different purpose from the two-validator confirmation rule used for transfers.
Under specified triggers, including a disaster, security incident or the end of the contract, Kiln says the recovery shares can be transferred securely to named Ledger recipients. Ledger also receives a daily copy of the validator database in storage it controls.
A recovery plan, rather than an automatic switch
The key material and database copy address different needs: recovering the validator’s identity and recovering its records. Having both available gives Ledger an agreed route to restore the infrastructure if the operating relationship breaks down.
The disclosure therefore adds more than another node to the existing Ledger wallet service. It sets out who checks transfers, what can continue during an outage and what recovery material Ledger can obtain. Kiln does not present that process as an uninterrupted live migration or promise a recovery time.
Sources: Kiln’s October 26 deployment account and Ledger’s original Canton Wallet announcement.
