KMS and hot-key strategy: HSM, cloud KMS, and separation of signing from API tier

[greatest0fallt1me]

Key management: integrate AWS KMS (or HSM) for hot signing with minimal blast radius

    ## Description

    If StreamPay still holds **keys** in env vars, plan migration to **KMS**-backed

signing, HSM for material keys, and split of control plane from data
plane so an API RCE cannot directly exfil raw seeds. This is a Soroban and
Stellar best practice for escrow operators.

    ## Requirements and context

    - **Threat** model: what attacks KMS blocks vs not.

• No long-lived unencrypted private keys in container image or disk.

• IAM least privilege; audit logs in cloud provider.

• Key rotation link to earlier dual-sign issue; rotation without downtime.

• Tests in dev with local-kms or similar mock; not live prod keys in CI.

    ## Suggested execution
  
    1. `git checkout -b feature/kms-stellar-signing`
  

2. Prototype one signing path; feature flag; measure latency.

3. PR with architecture diagram, security sign-off block.

4. If multi-month program, break into child issues; this issue is planning + first slice in 96h.

5. Compliance note in PR for fintech.

    ## Test and commit
   

• Run the full test suite; add or update tests until the agreed coverage bar is met.
• Cover edge cases listed in this issue; document any intentional exclusions with brief rationale in the PR.
• Include relevant test output (e.g. test runner summary) or a link to a passing CI run in the pull request.
• Add security notes for auth, keys, PII, chain settlement, or money movement (assumptions verified, out-of-scope items).

Example commit message

feat(security): integrate KMS for Stellar and Soroban signing; remove raw in-process keys

Guidelines

• Target: at least 95% coverage on new or meaningfully changed code (per the repo’s standard tooling).
• Documentation: update contributor-facing or API documentation where a reviewer would be blocked without it.
• Timeframe: 96 hours to ready-for-review (surface blockers early).

[2411015047-afk]

Hi! I saw this issue about KMS and hot-key strategy.

I have experience with:

• HSM and cloud KMS integration (AWS KMS, Google Cloud KMS)
• Separation of signing tier from API tier
• Secret management best practices for production deployments

This is a critical security infrastructure issue. Happy to discuss implementation options or help build out the signing/verification architecture.

I'm available for freelance work — DM me for rates and availability.