SOVRA is a t-of-n threshold signer that splits your private key into three shards — two active cosigners and a cold recovery shard — on hardware you own. Malware, a rogue AI agent, or full penetration of any single machine yields at most one share: never enough to sign. Lose a machine, and the cold shard restores the quorum.
MPC threshold signing is the industry standard behind Fireblocks, Copper, and Taurus. SOVRA is the open-source, self-hosted alternative — the same signing scheme, with no SaaS, no vendor lock-in, and no one else's cloud in your custody path.
A one-time Distributed Key Generation ceremony creates three independent shards on three machines. The complete private key is never assembled — not at generation, not at signing, not for an instant.
To sign, any two cosigners run the DKLs23 rounds directly peer-to-peer. The key exists only as mathematics distributed across the parties. Compromise one machine, and you hold exactly one share of nothing.
Disk failure, theft, fire — losing a cosigner is survivable by design. The cold shard bridges the outage, and a re-share ceremony rebuilds the lost shard at the same address while making the stolen one worthless.
The surviving cosigner and the cold recovery party keep signing immediately — the quorum never drops below two.
A recovery ceremony regenerates the lost shard on a fresh host and re-randomizes every other shard — no funds move, no address change.
Re-randomization invalidates the entire previous generation — the lost or stolen shard, and every old backup, becomes mathematically useless.
Per-cosigner allowlists for chain, recipients, value, and calldata — evaluated independently, fail-closed, one veto is final.
Every internal socket requires mutual TLS pinned to a project CA. A process without its certificates refuses to start.
Shards can be XChaCha20-Poly1305-sealed at rest — fail-closed, never falling back to plaintext — for any shard that leaves your desk.
A one-time ceremony derives three shards over the DKLs23 protocol. Each machine keeps its own; the derived address is verified independently by the operator.
The orchestrator selects two ready cosigners — cold party last. They run the threshold rounds peer-to-peer and return one valid ECDSA signature.
The assembled signature is verified and broadcast to the network — publicly auditable on-chain, indistinguishable from any other signature.