Secure split key changes the trust model for identity vendors

At a glance

What this is: This is an analysis of how splitting the identity-signing key changes the compromise model for SAML and OIDC, and why a single signing authority remains a high-impact trust concentration.

Why it matters: IAM teams should care because the control plane that mints identities can become the fastest route from one breach to many applications, which affects NHI governance, delegated trust, and human access recovery.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
• 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation.

👉 Read Newcore's analysis of secure split key for identity signing

Context

Identity signing keys matter because they sit upstream of every login an organisation trusts. In a SAML or OIDC model, the party holding the signing authority can mint assertions that applications will accept as authentic, which means compromise of that trust anchor can outscale ordinary credential theft.

This article examines the governance failure behind that design: one organisation holding unilateral custody of the key that signs access for another. For IAM, PAM, and NHI programmes, the question is not whether the protocol works, but whether the signing trust model creates a single compromise point that Zero Trust was supposed to eliminate.

Key questions

Q: How should security teams reduce blast radius in identity-first Zero Trust programmes?

A: They should focus on entitlement scope, not only authentication strength. Limit standing privilege, separate administrative access from routine access, and use just-in-time elevation for sensitive actions. That reduces what a compromised identity can do even if a password, token, or session is stolen.

Q: Why do identity signing keys create outsized risk for IAM programmes?

A: Because they sit above ordinary user authentication and determine what applications will accept as trusted. If an attacker steals the signing key, they do not need to break in as a user. They impersonate the authority that users and applications already trust, which turns a single secret into an enterprise-wide access path.

Q: What do security teams get wrong about Zero Trust and identity governance?

A: They often treat Zero Trust as an integration label rather than a continuous operating requirement. If identity signals are inconsistent across tools, the organisation may enforce local checks while still lacking enterprise-wide assurance. The mistake is assuming adoption equals execution when the data model and control surfaces do not line up.

Q: Who is accountable when a signing authority is compromised?

A: Accountability is shared across the vendor operating the signing environment and the customer that accepted unilateral custody of a critical trust function. That is why architecture and contract both matter. The governance question is whether the organisation knowingly allowed one party to hold a skeleton key to its applications.

Technical breakdown

Why token-signing authority becomes a skeleton key

In federated identity, the application does not authenticate the user directly. It trusts a signed assertion from an identity provider, and that trust is anchored in the provider’s private signing key. If an attacker obtains that key, they do not need passwords, MFA, or session replay. They can mint assertions that verify cleanly because the cryptographic signature is the proof the application relies on. This is why token-signing compromise behaves differently from ordinary account takeover: the attacker is not logging in, they are impersonating the trust authority itself.

Practical implication: treat signing keys as high-value control-plane assets, not ordinary secrets.

Why split-key signing changes the compromise boundary

Secure split key models apply threshold cryptography so no single party holds the complete signing key. Each side produces only a partial signature, and the final assertion is completed only when both shares participate. The security property is not just rotation or storage hygiene. It is that compromise of one environment no longer yields a usable signing secret. That changes the attacker’s job from stealing one key to breaching two independent trust domains that do not share the same admin population, endpoint stack, or operational controls.

Practical implication: evaluate whether your federation design still depends on one organisation being trusted to hold complete signing power.

Why Zero Trust must include the identity vendor itself

Zero Trust is often applied to networks, devices, and users, but the identity provider is frequently left with standing authority to vouch for everyone else. That creates a paradox: the system responsible for continuous verification is itself trusted unconditionally. In practice, this means the trust boundary stops at the vendor’s infrastructure rather than at the organisation’s own policy domain. Split-key approaches attempt to move that boundary so the customer remains part of the trust decision at signing time, not only at provisioning time.

Practical implication: map where trust is still unilateral in your federation architecture and remove it where the business cannot tolerate total compromise.

Threat narrative

Attacker objective: The attacker wants to impersonate users at scale by abusing the signing authority that applications already trust.

1. Entry occurs when an attacker compromises the identity vendor or its signing infrastructure and reaches the token-signing key.
2. Escalation follows when the attacker mints valid tokens or assertions for any target user without needing to authenticate normally.
3. Impact is enterprise-wide account impersonation, mailbox access, and application takeover across all services that trust the forged signatures.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Single-key federation is a control-plane concentration problem, not just an authentication problem. When one signing authority can mint access for an entire workforce, the identity layer becomes the fastest path from compromise to enterprise-wide impact. That is not a weakness in MFA or password policy. It is a structural property of unilateral trust. Practitioners should treat the signing key as a governance boundary, not just a cryptographic artefact.

Zero Trust does not survive if the identity provider remains exempt from its logic. Organisations spent years removing implicit trust from networks and devices, then left the signing authority with absolute standing power. That assumption was designed for a world where the verifier was outside the blast radius. It fails when the verifier itself is the breach point. The implication is that federation trust must be re-architected, not merely monitored more closely.

Secure split key is a named example of identity blast radius reduction. The useful concept here is not “more security” but reduced unilateral signing power across organisational boundaries. If one party cannot complete a login alone, then compromise of that party no longer equals compromise of every trusting application. That is the right governance question for IAM, PAM, and NHI teams: where else does one actor still hold an all-or-nothing trust key?

Identity vendors are becoming part of the attack surface they were originally meant to shield. Support systems, subprocessors, crash data, and internal admin tools all become relevant once the signing authority is concentrated in one place. This widens the governance problem from account compromise to trust-chain compromise. Security teams should re-evaluate which parts of the federation stack are operational dependencies and which are unacceptable single points of failure.

Federated identity needs lifecycle thinking for trust, not just for accounts. Keys age, trust relationships change, and delegated signing arrangements can persist long after the original rationale has expired. That is the same governance pattern practitioners already recognise in stale service accounts and orphaned access, but at a far higher blast radius. The implication is clear: signing authority should be reviewed, constrained, and periodically revalidated like any other critical privilege.

From our research:

• 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to The State of Secrets Sprawl 2026.
• 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded.
• For the broader control picture, read Guide to the Secret Sprawl Challenge for the operational rotation and remediation patterns behind these exposures.

What this signals

Identity blast radius is now a design metric, not a post-incident metric. When a signing authority can impersonate an entire workforce, the relevant programme question is how much damage one compromise can authorise before containment begins. That is why federated identity governance has to be evaluated alongside MITRE ATT&CK Enterprise Matrix style threat modelling and not only through uptime or login success measures.

Control ownership must follow the trust boundary, not the organisational chart. If a customer depends on another organisation to complete identity signatures, then the customer still owns the business risk even if the vendor runs the infrastructure. This is the same pattern seen in many NHI and delegated-access failures, where accountability lags behind technical custody.

Zero standing privilege should extend to signing authority wherever possible. A signing key that can be exercised unilaterally is standing privilege in cryptographic form. The programme implication is to identify where identity systems still operate with permanent trust grants and to narrow those grants before they become the easiest escalation path.

For practitioners

• Review all signing authorities for single-point compromise risk Inventory every SAML and OIDC trust path that depends on one organisation holding complete signing power. Flag any design where compromise of the identity provider could mint valid access without customer-side participation.
• Classify token-signing keys as control-plane secrets Move signing certificates and key material into the same governance tier as privileged infrastructure credentials, with stricter access review, break-glass controls, and monitored ceremony procedures.
• Map federation trust to explicit blast-radius scenarios Test what an attacker can do if the identity vendor, its support tooling, or its subprocessors are compromised. The control to judge is not uptime, but whether one breach can sign access across multiple applications.
• Separate trust domains for co-signing where feasible For high-value environments, evaluate whether a split-signing or dual-control model can remove unilateral custody of the signing key. The design objective is to make one compromised environment insufficient to complete authentication.

Key takeaways

• A single signing key can turn identity compromise into broad application impersonation, which is a governance failure as much as a technical one.
• The evidence from major incidents shows that forged assertions and stolen signing authority remain an active path to enterprise access abuse.
• Practitioners should reduce unilateral trust in federation, treat signing keys as control-plane secrets, and re-evaluate blast radius across the identity stack.

Key terms

• Token-signing authority: The trusted function that issues cryptographically signed assertions or tokens that applications accept as proof of identity. In federated IAM, control of this authority determines who can impersonate users, so it must be treated as a high-impact control-plane asset rather than a routine certificate.
• Split-key signing: A threshold cryptography model in which no single party holds the complete private key. Each participant contributes a partial signature, and a valid token is produced only when all required shares cooperate, reducing the blast radius of unilateral compromise.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Unilateral custody: A trust design in which one organisation alone can create or approve access decisions that downstream systems accept. In identity governance, unilateral custody is risky because compromise of that single holder can become compromise of every relying application.

What's in the full article

Newcore's full analysis covers the operational detail this post intentionally leaves for the source:

• Threshold cryptography and split-signing ceremony choices for SAML and OIDC deployments
• Deployment trade-offs for browser, edge, and device-anchored co-signing paths
• How the model behaves when a signing share is lost, rotated, or reissued
• The vendor's scenario matrix comparing legacy identity platforms with split-key signing

👉 Newcore's full post covers the token-signing model, co-signing mechanics, and blast-radius scenarios in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.