Four roles that must not be collapsed#
| Role | Documented custody |
|---|---|
| Deployment root | Unique to one owner; private key exists only in the passphrase-encrypted recovery artifact. |
| Online issuer | Encrypted owner-only local state; issues under deployment-local authority. |
| Relay identity | Encrypted owner-only local state for the owner’s relay. |
| Android device material | Protected local storage; a public enrollment request supports recipient-sealed profile issuance. |
The client must not become the operator#
Root recovery material, operator credentials, administrative commands and deployment-wide authority do not belong in a mobile profile, public QR or casual support bundle.
The self-hosting security guide describes software key custody. Hardware-backed operator adapters are not a current requirement or a feature to imply through marketing.
Handle recovery deliberately#
Do not put passphrases in arguments, environment variables or shell history. Keep recovery material off the VPS. Run kurdctl doctor after clock changes, storage recovery, upgrades or permission changes.
The guide says a clock repair requires the offline recovery artifact. Do not improvise a clock or signature bypass to make an expired profile connect.
Source and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.