@@ -21,6 +21,7 @@ defmodule Trinity.Effects.Boot do
     subject = %{
       "authority" => Trinity.Authority.selected_name(),
       "signer" => signer_subject(),
+      "key_custody" => key_custody_subject(),
       "otp_release" => List.to_string(:erlang.system_info(:otp_release)),
       "fips" => Atom.to_string(:crypto.info_fips()),
       "node" => Atom.to_string(node())
@@ -52,6 +53,29 @@ defmodule Trinity.Effects.Boot do
     end
   end
 
+  # Slice 025 AC1: the boot receipt names the custody adapter and the source it chose, so a reader
+  # of the chain can tell whether the signing key was held by a passphrase, a systemd credential or
+  # a TPM without asking anyone. It carries the key id and never key material.
+  @doc """
+  What the boot receipt records about key custody. Public so the test that asserts it carries no
+  key material can call the thing the receipt actually uses rather than a copy of it.
+  """
+  @spec key_custody_subject() :: map()
+  def key_custody_subject do
+    case Trinity.Keys.describe() do
+      %{adapter: adapter, source: source, key_id: key_id, detail: detail} ->
+        %{
+          "adapter" => inspect(adapter),
+          "source" => Atom.to_string(source),
+          "key_id" => key_id,
+          "detail" => detail
+        }
+
+      {:error, reason} ->
+        %{"unavailable" => inspect(reason)}
+    end
+  end
+
   defp signer_subject do
     case Trinity.Receipts.KeyCustody.selected() do
       %{algorithm: a, scheme: s, key_id: k} ->
 
@@ -161,6 +161,14 @@ defmodule Trinity.Receipts.KeyCustody do
     {pub, priv} = impl.generate_key()
     jwk = impl.jwk(pub)
 
+    # Slice 025: the private half is sealed by the key custody seam before it is written, so the
+    # file on disk is ciphertext and the thing that opens it is whatever the deployment's adapter
+    # holds. When no key source is available the key is written unsealed rather than not at all:
+    # refusing to boot because encryption at rest is unconfigured would trade a working signer for
+    # a stronger one nobody asked for, and the registry row records which of the two it is.
+    encoded = impl.encode_private(priv)
+    {private_b64, custody} = seal_private(encoded)
+
     {key_id, kid_scheme} =
       case jwk do
         nil -> {:crypto.hash(:sha256, pub) |> Base.url_encode64(padding: false), "sha256-raw"}
@@ -177,14 +185,15 @@ defmodule Trinity.Receipts.KeyCustody do
       "fingerprint" => :crypto.hash(:sha256, pub) |> Base.encode16(case: :lower),
       "valid_from" => DateTime.utc_now() |> DateTime.to_iso8601(),
       "status" => "active",
-      "custody" => "file"
+      "custody" => custody
     }
 
     file =
       JSON.encode!(%{
         "algorithm" => Atom.to_string(impl.algorithm()),
         "key_id" => key_id,
-        "private_b64" => Base.encode64(impl.encode_private(priv)),
+        "private_b64" => private_b64,
+        "custody" => custody,
         "public_b64" => Base.encode64(pub)
       })
 
@@ -195,13 +204,30 @@ defmodule Trinity.Receipts.KeyCustody do
     end
   end
 
+  # Slice 025. The signer holds no key-opening logic of its own: it hands bytes to the seam and
+  # takes bytes back. Swapping the custody adapter for a KMS changes `Trinity.Keys` and nothing
+  # here, which is the whole reason the seam exists.
+  defp seal_private(encoded) do
+    case Trinity.Keys.wrap(encoded) do
+      {:ok, wrapped} -> {Base.encode64(wrapped), "sealed"}
+      {:error, _reason} -> {Base.encode64(encoded), "file"}
+    end
+  end
+
+  # A key file written before slice 025 carries no `custody` field and holds the private bytes
+  # directly. It still opens: a slice that made every existing installation unbootable to gain a
+  # property would not be an improvement.
+  defp open_private(stored, %{"custody" => "sealed"}), do: Trinity.Keys.unwrap(stored)
+  defp open_private(stored, _row), do: {:ok, stored}
+
   # sobelow_skip reason: Traversal.FileModule: `path` is the selection's key path, built by
   # key_path/2 at boot from the keys directory and the algorithm, never input.
   @sobelow_skip ["Traversal.FileModule"]
   defp read_private(path, impl, key_id) do
     with {:ok, bin} <- File.read(path),
-         {:ok, %{"private_b64" => b64, "key_id" => ^key_id}} <- JSON.decode(bin),
-         {:ok, encoded} <- Base.decode64(b64) do
+         {:ok, %{"private_b64" => b64, "key_id" => ^key_id} = row} <- JSON.decode(bin),
+         {:ok, stored} <- Base.decode64(b64),
+         {:ok, encoded} <- open_private(stored, row) do
       {:ok, impl.decode_private(encoded)}
     else
       {:error, :enoent} -> {:error, :signer_unavailable}
 
@@ -0,0 +1,132 @@
+# SPDX-FileCopyrightText: Sudo Apt Holdings LLC
+# SPDX-License-Identifier: Apache-2.0
+defmodule Trinity.Keys.SignerSeamTest do
+  @moduledoc """
+  Slice 025, AC3 and AC1: the receipt signing key is sealed by the custody seam before it reaches
+  disk, opens again through it, and the boot receipt names which adapter and source held it.
+
+  The retrofit's obligation runs both ways. A key written *before* this slice carries no custody
+  field and holds its private bytes directly, and it must still open: a slice that made every
+  existing installation unbootable in order to gain a property would not be an improvement. That
+  case is tested here explicitly, by writing the old format.
+  """
+  use ExUnit.Case, async: false
+
+  alias Trinity.Keys.Local
+  alias Trinity.Receipts.{KeyCustody, KeyRegistry}
+
+  setup do
+    dir =
+      Path.join(System.tmp_dir!(), "trinity-signer-seam-#{System.unique_integer([:positive])}")
+
+    File.mkdir_p!(dir)
+
+    prior_keys = Application.get_env(:trinity, :keys)
+    prior_receipts = Application.get_env(:trinity, :receipts)
+    prior_pass = System.get_env("TRINITY_KEYS_PASSPHRASE")
+
+    Application.put_env(:trinity, :keys, dir: dir, source: :passphrase)
+    Application.put_env(:trinity, :receipts, Keyword.put(prior_receipts || [], :keys_dir, dir))
+    System.put_env("TRINITY_KEYS_PASSPHRASE", "a signer seam passphrase")
+    :persistent_term.erase({Local, :selection})
+
+    on_exit(fn ->
+      :persistent_term.erase({Local, :selection})
+
+      # KeyCustody.boot!/1 records its selection in :persistent_term, which outlives this test's
+      # process and every sandbox. Without putting the real one back, every later test in the run
+      # signs against a temporary directory this test has just deleted, and the failure surfaces
+      # as `signer_unavailable` in tests that have nothing to do with keys. Restoring the config
+      # is not enough: the selection has to be re-made from it.
+      restore = fn ->
+        if prior_receipts,
+          do: Application.put_env(:trinity, :receipts, prior_receipts),
+          else: Application.delete_env(:trinity, :receipts)
+
+        KeyCustody.boot!()
+      end
+
+      if prior_keys,
+        do: Application.put_env(:trinity, :keys, prior_keys),
+        else: Application.delete_env(:trinity, :keys)
+
+      if prior_pass,
+        do: System.put_env("TRINITY_KEYS_PASSPHRASE", prior_pass),
+        else: System.delete_env("TRINITY_KEYS_PASSPHRASE")
+
+      restore.()
+      File.rm_rf(dir)
+    end)
+
+    {:ok, dir: dir}
+  end
+
+  test "the signing key is ciphertext on disk and the registry says so", %{dir: dir} do
+    assert {:ok, selection} = KeyCustody.boot!(dir)
+
+    raw = File.read!(selection.key_path)
+    {:ok, row} = JSON.decode(raw)
+
+    assert row["custody"] == "sealed"
+
+    # The stored private value is what the seam produced, not the key itself: it carries the
+    # vault's wrapper marker, and the wrapper is longer than the key it holds.
+    {:ok, stored} = Base.decode64(row["private_b64"])
+    assert String.starts_with?(stored, "TKW1")
+
+    # And the registry row records the custody that actually held it, rather than a constant.
+    {:ok, rows} = KeyRegistry.read(dir)
+    assert %{"custody" => "sealed"} = KeyRegistry.lookup(rows, selection.key_id)
+  end
+
+  test "a sealed key still signs, which is the point of sealing it", %{dir: dir} do
+    assert {:ok, _selection} = KeyCustody.boot!(dir)
+    assert {:ok, signature} = KeyCustody.sign("some pae bytes")
+    assert is_binary(signature) and byte_size(signature) > 0
+  end
+
+  test "losing what opens the key makes the signer unavailable rather than silently wrong", %{
+    dir: dir
+  } do
+    assert {:ok, _} = KeyCustody.boot!(dir)
+    assert {:ok, _} = KeyCustody.sign("before")
+
+    File.rm!(Local.salt_path())
+    :persistent_term.erase({Local, :selection})
+
+    assert {:error, _reason} = KeyCustody.sign("after")
+  end
+
+  test "a key file written before this slice still opens", %{dir: dir} do
+    # Boot once to get a real keypair and registry row, then rewrite the file in the old shape:
+    # no custody field, private bytes stored directly.
+    assert {:ok, selection} = KeyCustody.boot!(dir)
+    {:ok, row} = JSON.decode(File.read!(selection.key_path))
+    {:ok, wrapped} = Base.decode64(row["private_b64"])
+    {:ok, plain} = Trinity.Keys.unwrap(wrapped)
+
+    old_format =
+      row
+      |> Map.delete("custody")
+      |> Map.put("private_b64", Base.encode64(plain))
+      |> JSON.encode!()
+
+    File.write!(selection.key_path, old_format)
+
+    assert {:ok, _} = KeyCustody.boot!(dir)
+    assert {:ok, signature} = KeyCustody.sign("pae bytes from an old installation")
+    assert is_binary(signature)
+  end
+
+  test "AC1: the boot receipt subject names the adapter, the source and no key material" do
+    subject = Trinity.Effects.Boot.key_custody_subject()
+
+    assert subject["adapter"] =~ "Trinity.Keys.Local"
+    assert subject["source"] == "passphrase"
+    assert is_binary(subject["key_id"])
+    assert subject["detail"] =~ "PBKDF2"
+
+    {:ok, material} = Trinity.Keys.fetch(:receipts)
+    refute String.contains?(JSON.encode!(subject), Base.encode64(material))
+  end
+end