{"algorithm":"Ed25519","provider":"injected_secret","custody_model":"environment-injected secret","runtime_environment":"development","key_id":"24653ea7b563d08f","key_version":"v1","activated_at":"","private_key_exported_by_api":false,"non_exportable_key_claimed":false,"production_injected_secret_allowed":false,"current_limit":"AWS KMS non-exportable signing is live when provider=aws_kms is configured; injected_secret remains a temporary migration mode.","target_state":"Non-exportable managed KMS/HSM signing with witnessed rotation and revocation.","managed_provider_contract":{"status":"aws_kms_implemented","required_environment":["SENTINEL_RESPONSE_SIGNING_PROVIDER","SENTINEL_RESPONSE_SIGNING_KMS_KEY_ID","SENTINEL_RESPONSE_SIGNING_KMS_KEY_VERSION","SENTINEL_RESPONSE_SIGNING_KMS_PUBLIC_KEY_B64","SENTINEL_RESPONSE_SIGNING_KMS_ATTESTATION","SENTINEL_RESPONSE_SIGNING_KMS_SIGNING_ALGORITHM","AWS_REGION"],"required_behavior":["private key material never enters the Sentinel application process","provider signs exact canonical response and evidence payload bytes","provider exports stable public key and key version metadata","provider supports witnessed rotation and revocation audit records"],"implemented":true,"implemented_providers":["aws_kms"],"pending_providers":["aws_cloudhsm","azure_key_vault","customer_managed_kms","gcp_cloud_kms","managed_hsm","managed_kms"],"provider_interfaces":{"status":"aws_kms_implemented_cloudhsm_pending","interfaces":["KeyCustodyProvider"],"first_targets":["AWSKMSCustodyProvider","AWSCloudHSMCustodyProvider"],"required_methods":["sign","public_key","rotate_key","attest_key_provenance"],"implemented":true,"implemented_providers":["aws_kms"],"pending_providers":["aws_cloudhsm"],"runtime_behavior":"aws_kms_live_cloudhsm_fail_closed"}},"compromise_runbook":"/security#root-of-trust"}