Key generation, storage, backup and transaction approval matter alongside application integrity. Local protection cannot correct a transaction signed for the wrong address.
Evaluation approach
Define where keys originate, their permitted uses and recovery methods. Verify algorithm and device support before relying on hardware-backed storage; not every blockchain key works in every platform's secure hardware.
Application example
Compare the address and amount shown to the user with the signed transaction. Suspicious environments may restrict signing, with clear notice that nothing has been broadcast. Include recovery in the assessment.
Limits and considerations
Even a non-exportable key may be misused through an authorized application. Bind user approval to the correct transaction.
Checks and decisions
- Verify algorithm support
- Bind signing to displayed content
- Review recovery
State the custody model clearly and assess RASP together with key access, approval and server controls.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.