[HARD][CUSTODY] Add threshold signing and safe key rotation for issuer and distribution accounts

[Obiajulu-gif]

Problem

Mainnet issuer and distribution operations need custody that does not depend on one hot secret and remains recoverable during signer loss or compromise.

Scope

• Define signer roles and thresholds for issuance, payouts, emergency actions, and recovery.
• Add an HSM/KMS/external-signer adapter; app processes never receive master secrets.
• Build network-, source-, sequence-, time-, memo-, and intent-bound envelopes.
• Enforce allowlists, limits, separation of duties, and environment binding.
• Implement overlap-safe rotation, recovery quorum, and rollback.
• Persist tamper-evident approval, submission, and final-ledger records.
• Document compromise, lost signer, stuck sequence, partial signature, and outage scenarios.

Acceptance criteria

• No single app credential executes high-risk operations.
• Raw secrets never enter env vars, logs, database, or repository.
• Cross-network and cross-intent replay fails.
• Rotation preserves threshold and continuity.
• Every envelope traces to policy, approvals, and ledger result.

Required tests

Threshold matrices, stale sequences, replay, rotation with pending approvals, signer outage, recovery, and secret scanning.

Non-goals

Do not mandate a specific custody vendor.

[harystyleseze]

I have experience building secure backend systems and cryptographic signing workflows. I've reviewed the requirements and can implement a vendor-agnostic threshold signing solution with external signer (HSM/KMS) support, policy-bound signing envelopes, replay protection, separation of duties, and overlap-safe key rotation with recovery. I'll also add comprehensive audit trails and tests covering threshold scenarios, rotation, replay, stale sequences, signer outages, and recovery before submitting a well-tested PR.

[grantfox-oss]

🦊 GrantFox — @harystyleseze has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #131)
2. Your PR will be reviewed by the Chainmove maintainers

Good luck! Track your progress on GrantFox.