We're building an application which will leverage blockchain for financial transaction within itself.
We won't be forcing users to manage their own keys. Our clients (we're building a B2B platform) will manage keys for their users. We are building a white-label platform and need to provide key-management as a solution.
We don't want to develop the key management system ourselves.
The needs of the system:
- Securely store private keys of users
- Sign data with private keys within the system (no decrypted keys leaving or entering)
- Generate new keys
- Communicate with our backend through an API
We've looked into self-hosted HSM and CloudHSM solutions. Alternatively we would use HashiCorp Vault or Amazon Secrets Management.
What are the best practices?