What Is a Key Ceremony? How Custodians Generate Crypto Keys

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. A key ceremony is a scripted, witnessed and recorded procedure for generating, splitting and storing the keys that control client assets. People in separate roles follow the script on secured hardware, leaving evidence an auditor can check.

Watch: What Is a Key Ceremony? How Custodians Generate Crypto Keys 1:33

Video transcript

Key generation is a high-risk moment for any custodian. Whoever controls it could copy a key, weaken it or record the wrong address.

A key ceremony makes that moment provable. It is a scripted, witnessed and recorded procedure for generating, splitting and storing the keys that control client assets.

In the room: a ceremony administrator running the script, the share holders a quorum needs, witnesses who hold no keys, and an auditor. Each person holds only one trusted role.

What the record must show depends on the custody model: who can activate an HSM key, where each MPC share sits, or that each multisig signer made their own key.

Keep evidence an auditor can check: the approved script and every deviation, attendees and roles, devices and tamper seals, the validated entropy source, addresses checked by a second person, and a video or signed log.

Weak entropy is one common failure. In 2022, 1inch disclosed that the Profanity tool seeded private keys from a random 32-bit value. That left about 4 billion possible seeds, and keys could be recovered.

Guardian's OpSec audit reviews where keys live, who holds which share, and what a quorum requires in practice. Our compliance evidence includes key ceremony and recovery records.

Read the full article, or talk to Guardian about having your key ceremonies reviewed.

Key generation is a high-risk moment for any custodian. Whoever controls it could copy a key, weaken it or record the wrong address.

A key ceremony makes that moment provable. The practice is older than crypto, and its best models publish their rules.

Key Ceremonies Defined

A key ceremony covers any planned operation on high-value keys: generating, splitting, backing up or using them under a quorum.

It produces two things: keys held as designed, and evidence that the procedure was followed.

Two reference models

The DNS root. IANA usually holds ceremonies four times a year to perform operations with the root zone's key signing key.
Certificate authorities. A CA generating a root key must follow a Key Generation Script, with an auditor watching or a video of the whole process.

The CA/Browser Forum defines that script as "a documented plan of procedures for the generation of a CA Key Pair". Swap in a wallet key and you have a custody ceremony.

Not the same as a trusted setup

Ethereum's 2023 KZG ceremony was a trusted setup for EIP-4844. Each participant mixed in a secret, and the Ethereum Foundation says one concealed secret keeps it secure.

A custody ceremony is the opposite. The key must survive, and no single person may ever hold it alone.

Who Is in the Room

The root zone key's DNSSEC practice statement lists six trusted roles. Five are below; the sixth is system administrators.

Role at the DNS root	What they do
Ceremony administrator	Records each step, collects the logs and signs the record
Crypto officers	Hold credentials that activate the HSM; three of seven are needed
Safe security controllers	Control access to the HSMs and activation material
Internal witnesses	Take part in access to the safe room
Recovery key share holders	Hold shares that recover the key protecting backups

Two rules from the same statement are worth copying:

A trusted person holds only one trusted role.
Auditors take no part in the multi-person control of the key.

For a custodian, crypto officers become key or share holders, and the quorum becomes the signing threshold. The witness should hold no key.

Environment and Equipment

The CA/Browser Forum sets a floor for every CA key. The CA shall:

generate the key in a physically secured environment;
use people in trusted roles, under multiple-person control and split knowledge;
generate it inside cryptographic modules that meet its stated requirements;
log the generation activities.

The DNS root requires HSMs validated to FIPS 140-2 or 140-3 at level 3 or higher. Physical access is logged and video recorded.

Crypto custody rules point the same way. Hong Kong's SFC, in its August 2025 custody circular, says licensed trading platforms should:

where practicable, generate seeds and keys offline and store them somewhere secure, such as a certified HSM;
generate and safeguard them on air-gapped cold wallet devices.

Our guide to the SFC custody circular covers the rest.

The CryptoCurrency Security Standard (CCSS v9) asks that key material be generated by the actor who will use it, with sufficient entropy. The generation method should be validated before use.

HSM, MPC and Multisig Ceremonies

What the ceremony has to prove depends on the custody model.

Model	What is created	What the record must show
HSM	One key, generated inside a certified module	Who can activate it, and how backups are protected
MPC	Key shares on separate machines	Where each share sits, and who controls each machine
Multisig	One key per signer, plus an onchain threshold	Each signer made their own key; owners and threshold match the design

In MPC, Fireblocks says shares are created across separate endpoints and "the complete key is never assembled in one place". The ceremony covers each share's device instead of one key.

In a Safe multisig, each owner signs with its own key, and a set number of owners must confirm. Owners and threshold can change later, so check the deployed values against the record.

Script, Evidence and Recordings

The script comes first. CCSS v9 asks for a detailed runbook that defines every step, with participants signing off after each one.

At the DNS root, ceremony activities are recorded, dated and signed by the ceremony administrator. Logs are copied to at least two media, one stored offsite.

Keep this evidence for every ceremony:

The approved script, and every deviation from it.
Attendees, roles and witnesses, with identity checks.
Each device or HSM, its firmware and its tamper seals.
The entropy source, and how it was validated.
Public keys and addresses, checked against the record by a second person.
A video recording or signed log of the whole ceremony.

What auditors look for

For a root CA key, a qualified auditor must report on whether the CA "followed its key ceremony", and on the controls protecting the key pair.

The DNS root's key operations get an annual SOC 3 audit, and IANA publishes the report.

Expect a custody auditor to test the same chain: the script, the signed record, the recording, and keys in use that match the record.

Our guides to crypto custody and private key management cover the controls around the ceremony.

Common Ceremony Failures

Check every ceremony for these:

Weak entropy. Keys look random but come from a small seed space.
A networked machine. Keys are generated on a device that can reach the internet.
Role overlap. One person is witness and key holder, or holds a quorum alone.
Unrecorded deviations. A step is skipped or improvised and never written down.
Unchecked addresses. No one compares the derived address with the one being funded.
Untested backups. Shares are stored but never used in a timed recovery.
Stale quorums. Holders leave or lose devices, and shares are never reissued.

Weak entropy has a public example. In September 2022, 1inch disclosed that the Profanity vanity address tool seeded 256-bit private keys from a random 32-bit value.

That left about 4 billion possible seeds, and 1inch's researchers showed keys could be recovered from Profanity addresses. A validated generation method is the defense.

How Guardian Reviews Key Ceremonies

Guardian's OpSec audit covers custody and key ceremony. It reviews "where the keys live, who holds which share, what a quorum requires in practice, and what happens the day someone leaves or a device is lost".

The Digital Asset Assurance Pilot includes the same review. It maps CCSS levels, ISO 27001 and NIST CSF onto the actual key ceremony and change control.

For regulatory compliance, Guardian's evidence includes key ceremony and recovery records, beside signer inventories, thresholds and timelocks read from the chain.

For institutions, Guardian advises on custody and signing while they are still decisions.

Frequently Asked Questions

What is a key ceremony in crypto custody?

A scripted, witnessed and recorded procedure for generating, splitting, backing up or using the keys that control client assets. People in separate roles take part, and the record lets an auditor confirm what happened.

Who attends a key ceremony?

A ceremony administrator who runs the script, the key or share holders a quorum needs, and witnesses who hold no keys. An auditor attends or reviews a recording. At the DNS root, each person holds one trusted role.

Is a key ceremony the same as a trusted setup ceremony?

No. A trusted setup, such as Ethereum's 2023 KZG ceremony, combines many participants' secrets and stays secure if one participant conceals theirs. A custody key ceremony creates keys that must survive, under controls that stop any one person holding them.

Do regulators require key ceremonies?

Few crypto rules use the term. Hong Kong's SFC expects keys generated on air-gapped devices. For root CA keys, the CA/Browser Forum requires a script and an auditor's witness or video. The ceremony record is the proof.

Sources

Have your key ceremonies reviewed by Guardian

Guardian checks where your keys live, who holds each share and what your quorum requires in practice, and turns the result into evidence auditors can read.

Talk to Guardian Explore institutional security