External Key Backends
By default, Paradym generates and stores your certificates’ private keys in software. With an external key backend, the keys live in a key manager instead: they’re generated there, never leave it, and every signature happens inside it.
Paradym supports Google Cloud KMS, always backed by a Cloud HSM. Software stays the default, so nothing changes until you pick another backend when creating a certificate.
How it works
When you create a root certificate on an external backend, its key is generated there, and so is the key of the leaf certificate Paradym derives from it. Credentials and presentation requests are signed in the key manager too.
Each wallet gets its own key space, created automatically, so keys from different wallets are never mixed.
Selecting a backend that isn’t enabled is rejected. Paradym never falls back to software.
Supported key types
| Backend | P-256 | Ed25519 |
|---|---|---|
software | Yes | Yes |
gcpKms | Yes | No |
Cloud KMS can’t create Ed25519 keys, so certificates on it must use P-256. An unsupported combination is rejected with 422 Unprocessable Entity before any key is created, and the dashboard doesn’t offer it.
Key lifecycle
External keys cost money for as long as they exist, so Paradym cleans them up. Once every certificate a key backs is revoked or expired, the key is retired: it stops signing immediately, and it’s destroyed after a 30-day grace period. Pending credential offers that would be signed with it are expired too. Keys that nothing refers to anymore are cleaned up as well, and deleting your account destroys all of its keys.
Deactivating a certificate doesn’t retire its key, because a deactivated certificate can still revoke the credentials it issued. Paradym never revokes imported (externally signed) certificates, so their keys stay until the certificate expires, unless you delete them yourself.
You can cancel a deletion during the grace period, as long as the key would still be useful: its certificate isn’t revoked or expired, or it has an active signing request. That rules out automatic deletions, since those keys can’t sign anything useful anymore.
Software keys follow the same lifecycle, grace period included.
Google Cloud KMS
Cloud KMS doesn’t destroy keys right away: it holds them for a window set when the key is created. Paradym sets that window to the whole grace period, so Google itself refuses a retired key until it’s destroyed. Google charges for the key until it’s destroyed, so it stays billable until then.