Topic starter
14/08/2026 6:34 pm
TL;DR: A single token-signing key can turn an identity vendor compromise into enterprise-wide account takeover, according to Newcore, citing incidents such as the 2023 Microsoft token-signing key theft and Golden SAML. The core issue is that identity platforms still concentrate unilateral signing authority in one place, creating a trust assumption that Zero Trust never removed.
Editorial analysis by NHI Mgmt Group, based on content published by Newcore: “Secure Split Key: No Single Key, No Single Point of Compromise for IdP”.
Key questions
Q: What breaks when an identity vendor is compromised?
A: When an identity vendor is compromised, the break is often not limited to the vendor environment.
Q: Why do signing-key compromises create such large blast radius?
A: Because relying applications usually trust the signature, not the path the signer took to create it.
Q: What are the signs that identity trust material is too concentrated?
A: Warning signs include one organisation controlling all signing authority, recovery paths that can recreate tokens without secondary approval, and vendor support processes that can influence authentication outcomes.
Practitioner guidance
- Review signing authority custody Map which party can complete identity assertions today, where the private key or equivalent trust material lives, and whether any single compromise can mint valid access across all relying apps.
- Separate issuance from unilateral control Require architectures that prevent one organisation from independently producing accepted assertions for your workforce, especially where the identity vendor also operates support and recovery tooling.
- Reassess vendor breach blast radius Test vendor compromise scenarios against your actual federated apps, including mailbox access, SaaS admin paths, and recovery workflows that may trust the issuer without secondary verification.
Bottom line: A single signing key can turn an identity platform compromise into organisation-wide impersonation, which is why issuer custody is the central trust problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:42 pm
Unilateral signing authority is the real identity trust defect. The problem is not simply that vendors can be breached, but that a single vendor-held key can make the breach authoritative everywhere downstream. That design creates a customer-wide trust dependency that traditional perimeter thinking never removed. The practitioner conclusion is to measure identity risk by who can sign, not just who can authenticate.
A few things that frame the scale:
- The average worker in a typical enterprise holds 96,000 entitlements, and 38% of IdP accounts are dormant, according to Veza's 2026 State of Identity and Access Report.
A question worth separating out:
Q: How should teams evaluate split-key signing versus traditional federation?
A: Use split-key signing when the business requirement is to keep standard federation while removing unilateral issuer custody. Traditional federation centralises trust in the identity provider, while split signing distributes the act of authorisation itself. The decision is about whether you can tolerate a single organisation being able to impersonate your users.
👉 Read our full editorial: Secure split key changes the trust model for identity vendors