Startup Sequence

BVKS requires manual root key entry at startup.

Steps

Operator retrieves KSK from offline storage
KSK entered into BVKS
BVKS unwraps all SUKs
SUKs stored in locked memory
KSK memory is zeroized
KSK discarded

After this point:

KSK no longer exists in memory or disk

Implications

server restart required to add new SUKs
protects against disk theft or backups leaking root key
removes persistent root-of-trust

Design goal

Root key must never be recoverable from the running system.