In keyless artifact signing, what happens to the private key that produced the signature?
answer
- custody, not cryptography
- how long does the key live?
- identity proved instead of secret stored
- short-lived certificate over an ephemeral key
- public log entry makes later verification work
basics
~10 sKeyless signing still uses a private key, but it is generated for that one signing operation and destroyed immediately afterwards. Nothing long-lived is left behind to store, guard, rotate, or lose.
solid answer
~50 s"Keyless" does not mean keyless cryptography — it means no key custody. The signer generates a fresh keypair in memory, presents an identity token from an OIDC issuer proving who or what it is (a workload in a specific repository, a specific human), and a certificate authority issues a certificate valid for minutes that binds those identity claims to that ephemeral public key. The artifact is signed, the signature and certificate are published alongside it and recorded in a public append-only transparency log, and the private key is thrown away. What disappears is the custody problem: there is no passphrase in a shared password manager, no key on one laptop, no secret that departed maintainers might still hold. What remains is a different question — who can cause an identity to be issued in your name.
go deeper
Be ready to say plainly that a key still exists, is created for one signature, and is then destroyed, and that identity is proved with a short-lived token rather than by holding a secret.
Expect to walk the full sequence: ephemeral keypair, identity token, short-lived certificate binding identity claims to that public key, signature, transparency log entry, key discarded — and to explain how verification works after expiry.
An interviewer expects you to name the trade honestly: key custody is gone, but the ability to obtain a certificate under your identity is now the asset, and log monitoring is the only detection you have.
Own the decision of whether to adopt it at all: it removes a recurring custody obligation your organisation was probably failing at, in exchange for a dependency on an identity provider and a log you do not run.
## The confusion the name creates "Keyless signing" is a bad name for a good idea. Every digital signature is produced by a private key; there is no signature scheme that works without one. What keyless signing removes is not the key but the **custody of the key** — the long-lived secret that somebody has to generate, store, back up, restrict access to, rotate, and eventually explain the whereabouts of. ## What actually happens at signing time 1. **An ephemeral keypair is generated in memory.** It exists only for this one signing operation. 2. **The signer proves an identity.** It obtains a short-lived identity token from an OIDC issuer. In a CI setting that token asserts machine facts — the issuer, the repository, the workflow, the branch or environment. For a human it asserts an email or account identity from their provider. 3. **A certificate authority issues a short-lived certificate.** The CA validates the token and issues a certificate — validity measured in minutes, not years — that binds the identity claims from the token to the ephemeral public key. 4. **The artifact is signed** and the signature plus certificate are published with it. 5. **The event is recorded in a public transparency log**, an append-only structure that anyone can read and audit. 6. **The private key is discarded.** It is never written to disk, never escrowed, never backed up. ## Why the discard is the whole point A long-lived signing key is an asset that only ever accumulates risk. Consider a three-maintainer library whose release key was generated years ago, with the passphrase kept in a shared password manager. Two of the three maintainers have since moved on. Nobody can enumerate who still holds a copy, whether it was ever exported, or which machines it touched. Nothing was stolen and no incident occurred — and the key is still untrustworthy, because custody cannot be demonstrated. That is a **bus-factor and provenance-of-custody problem**, not a storage problem, and no amount of better storage fixes it. An ephemeral key has no such history. It cannot be exfiltrated later because it does not exist later. It cannot be held by a former colleague. It never needs a rotation schedule, because it rotates on every single signature by construction. ## The part people get wrong: verification after expiry If the certificate is valid for ten minutes, how does a consumer verify the artifact a year later? Not by the certificate still being valid — it is long expired, and that is expected. Verification checks that the signature was made **while** the certificate was valid, and the evidence for that is the transparency log entry: the log records the signature and certificate and countersigns the entry with its own timestamp. A verifier checks the signature against the certificate's public key, checks the certificate chains to a CA root it trusts, and checks the log's timestamped entry (or a bundled inclusion proof carried with the artifact) to establish that the signing happened inside the validity window. Expiry stops being a revocation problem and becomes a *bounded window* — a stolen credential is only good for minutes, and there is nothing to steal afterwards. ## What keyless does not remove The cryptography is identical to key-based signing; a signature from a discarded key is exactly as strong. What changes is what an attacker has to obtain. With a stored key they steal the key. With keyless they need to make your identity provider mint a token for your workload — which means the people and systems that control the CI organisation, the repository configuration, and the issuer's trust settings now hold what the key used to hold. Custody did not vanish; it moved to an identity system and to a log. Recognising that trade honestly is the difference between a candidate who has read the marketing and one who has operated it. ## How to say it in an interview "There is a key — it lives for one signing operation and is destroyed. Identity is proved with an OIDC token, a CA issues a minutes-long certificate over the ephemeral public key, and the event goes into a public transparency log so it can still be verified after the certificate expires. That removes key custody; it does not remove the question of who can get a certificate issued as us."
- If the signing certificate expired minutes after it was issued, how can anyone verify the artifact a year later?Verification does not require the certificate to be valid now — it requires proof that the signature was made while it was valid. The transparency log entry supplies that: the log records the signature and certificate and countersigns the entry with its own timestamp, and a verifier checks the certificate's validity window against that timestamp (or against an inclusion proof bundled with the artifact) rather than against the clock today.
- Why record the signing event in a public log at all, if the key is already gone?Two reasons. Verification: without a trustworthy record of when signing happened, an expired certificate is unusable evidence. Detection: an append-only public record is the only way anyone can later notice that a certificate was issued for your identity when you did not build anything. The log does not prevent a bogus issuance; it makes issuance discoverable to someone who watches it.
- Is a signature made with a discarded key cryptographically weaker than one made with a stored key?No. The algorithm and key strength are the same, and the signature is equally valid forever. The difference is entirely in what an attacker must obtain: a stored key can be exfiltrated at any point in its life, while an ephemeral key is unreachable a second after signing. Keyless changes the attack surface, not the mathematics.
Like a visitor day pass instead of a permanent badge: you prove who you are once at the desk, the pass works for a short window, and there is nothing left in circulation afterwards for someone to find in a drawer.
saying these in an interview costs you the question
- Says keyless signing uses no key at all
- Thinks the certificate must still be valid at verification time
- Believes discarding the key removes every attacker path
- Confuses the OIDC identity token with the signing key
- Assumes the transparency log prevents bad certificates being issued