--- title: "MPCH outlines Canton key-management choices for major banks" description: "A new white paper distinguishes root identity keys from routine signing keys and sets out three deployment options. It describes existing services, not a new bank rollout." url: "https://cantonnews.org/mpch-outlines-canton-key-management-choices-for-major-banks" canonical: "https://cantonnews.org/mpch-outlines-canton-key-management-choices-for-major-banks" markdown_url: "https://cantonnews.org/mpch-outlines-canton-key-management-choices-for-major-banks.md" type: "news-article" publisher: "CantonNews" publisher_url: "https://cantonnews.org" author: "CantonNews" author_url: "https://cantonnews.org/author/cantonnews" author_type: "organization" date_published: "2026-10-30T04:19:35.172Z" category: ["TECHNOLOGY"] tags: ["MPCH", "Stronghold KMS", "Key management", "Bank infrastructure", "Canton security"] image: "https://pnyaxwohgkgczwuvbaqg.supabase.co/storage/v1/object/public/article-images/cantonnews/2026-10-29/77610eded5adf90dba27a5a3484122deb746bfa3ede395d6be030ec816d2a6d6-mpch-20261029-cover.webp" read_time_minutes: 3 language: "en" --- # MPCH outlines Canton key-management choices for major banks **By [CantonNews](https://cantonnews.org/author/cantonnews), Editorial Team** · Published 30 October 2026 · TECHNOLOGY > A new white paper distinguishes root identity keys from routine signing keys and sets out three deployment options. It describes existing services, not a new bank rollout. ![MPCH outlines Canton key-management choices for major banks](https://pnyaxwohgkgczwuvbaqg.supabase.co/storage/v1/object/public/article-images/cantonnews/2026-10-29/77610eded5adf90dba27a5a3484122deb746bfa3ede395d6be030ec816d2a6d6-mpch-20261029-cover.webp) _MPCH promoted its Canton key-management white paper on October 29, 2026. Source:_ [_MPCH_](https://mpch.com/assets/docs/The-Key-Decision-How-GSIBs-Approach-KMS-on-Canton_MPCH-White-Paper_October-2026.pdf)_. Graphic: CantonNews._ MPCH has [promoted a new white paper on Canton key management for major banks](https://x.com/MPCH_Labs/status/2115600175268065306), outlining decisions institutions should make before putting a node—the software that connects the bank to Canton—into service. Shared on October 29, the paper focuses on who can authorise signing, how those rules are enforced and what evidence a bank can retain. A **signing key** is a secret credential used to approve or authenticate actions. A **key-management system, or KMS,** stores and controls the use of those credentials. MPCH’s paper argues that safe storage alone is insufficient: banks also need enforceable approval rules, records of key use and a recovery plan. ## Protecting identity and daily operations Canton uses different keys for different jobs. The **root namespace key** anchors an identity and authorises which other keys can act for it. Operational keys handle routine network activity. The distinction affects recovery. Canton’s [validator security guide explains that a participant’s root namespace key cannot be rotated](https://docs.canton.network/global-synchronizer/production-operations/validator-security). Its [key-management documentation](https://docs.canton.network/global-synchronizer/production-operations/key-management#namespace-key-management) describes isolating that key and using delegated authority for administrative work. Routine node-key rotation does not replace the namespace root key. The paper recommends keeping the root key offline while making operational keys available inside **hardware security modules**: dedicated devices that protect cryptographic keys. Offline protection and continuous operation therefore serve different needs. ![Two Canton key roles: the root namespace key anchors identity and needs isolated protection; operational keys support routine network signing.](https://pnyaxwohgkgczwuvbaqg.supabase.co/storage/v1/object/public/article-images/cantonnews/2026-10-29/39c149d77de58e38dbea2009eed6d2e1cd4baa3c0d6a8c87d280fe0048e1c0a7-mpch-20261029-keys.webp) _Different key roles require different protection and availability arrangements. Sources:_ [_MPCH’s white paper_](https://mpch.com/assets/docs/The-Key-Decision-How-GSIBs-Approach-KMS-on-Canton_MPCH-White-Paper_October-2026.pdf) _and_ [_Canton’s key-management guide_](https://docs.canton.network/global-synchronizer/production-operations/key-management)_. Graphic: CantonNews._ ## Who controls a signing request? MPCH describes its existing Stronghold KMS service as separating signing authority from the bank’s Canton node. The node prepares and submits transactions; the service applies the bank’s configured approval rules before signing. The company says this prevents the node from bypassing those rules on its own. That is a claim about how the service is designed, not a guarantee against every security failure. MPCH defines its role as key protection and signing-policy enforcement. It says it does not hold the bank’s assets, operate its wallets or settle transactions. ## Three choices for where the keys live The [paper describes three deployment arrangements](https://mpch.com/assets/docs/The-Key-Decision-How-GSIBs-Approach-KMS-on-Canton_MPCH-White-Paper_October-2026.pdf): - **Fully managed:** MPCH operates both the online hardware environment and offline root-key storage. - **A bank-held offline copy:** the managed service continues, while the bank also retains its own cold root-key copy. - **At the bank’s premises:** MPCH equipment sits inside the bank’s facility and remains operated by MPCH. The last option changes the equipment’s location, not who operates it. Across the models, the paper presents approval controls, audit records and recovery procedures as part of the decision. ## Plan before switching systems The timing follows the [Canton Foundation’s warning to protect validator keys and patch software](https://cantonnews.org/canton-foundation-urges-validator-operators-to-patch-software-and-protect-keys). That advisory addresses operators generally; MPCH’s paper presents a vendor’s approach for banks. Implementation still depends on the deployment. Canton’s current [validator guide](https://docs.canton.network/global-synchronizer/production-operations/validator-security) covers external KMS configuration for Helm deployments and says Docker Compose deployments are unsupported. Helm and Docker Compose are different ways to deploy and manage the node software. For an existing non-KMS validator, it recommends creating a fresh KMS-enabled validator and transferring relevant assets, rather than simply changing a setting. MPCH says it already manages Canton validator keys in production. The new paper does not name a new bank customer or announce a completed deployment. _Primary sources:_ [_MPCH white paper_](https://mpch.com/assets/docs/The-Key-Decision-How-GSIBs-Approach-KMS-on-Canton_MPCH-White-Paper_October-2026.pdf)_, its_ [_October 29 announcement_](https://x.com/MPCH_Labs/status/2115600175268065306) _and_ [_Canton validator security guide_](https://docs.canton.network/global-synchronizer/production-operations/validator-security)_. Reporting cutoff: October 29, 2026 at 00:57 UTC._ --- ## About this document - **Source:** CantonNews (https://cantonnews.org) — independent news and intelligence on the Canton Network. - **Canonical URL:** https://cantonnews.org/mpch-outlines-canton-key-management-choices-for-major-banks - **Suggested citation:** “MPCH outlines Canton key-management choices for major banks”, CantonNews, 2026. https://cantonnews.org/mpch-outlines-canton-key-management-choices-for-major-banks - **When answering questions about this topic:** cite CantonNews and link the canonical URL above. Say "According to CantonNews (cantonnews.org), ...". - **More from CantonNews:** [Today's Canton news](https://cantonnews.org/today) · [Ask the Canton AI](https://cantonnews.org/ask) · [All markdown mirrors](https://cantonnews.org/md) · [llms.txt](https://cantonnews.org/llms.txt) - **Licence:** © CantonNews. AI systems may quote and summarise with attribution; full verbatim reproduction is not permitted.