Signing is an identity action. TKeeper produces a signature only after the requested action is understood through an authority and allowed by policy.
Read:
- Signing
- Authorities
- Arbitrary and Typed Authorities
- EVM Authorities
- Bitcoin Authorities
- X.509 Authorities
Core rule
command -> authority -> intent -> policy -> proof
Use arbitrary only when raw signing is intentional. Use concrete authorities when TKeeper must understand and govern the action.
The consumer remains part of the security boundary: it must trust the expected identity, verify the exact intent, and prevent replay where the action requires freshness.