How Daml sign message content by using keys stored in HSM

Hi, I am aware that When two system entities such as a participant, domain topology manager, mediator or sequencer communicate with each other, they will use asymmetric cryptography to encrypt messages and sign message contents such that only the recipient can decrypt the content, verify the authenticity of the message, or prove its origin. But my question is how Daml is using the keys stored in HSM to sign the message content? Is it like Daml take the key location from a configuration file? Or message signing is happening in middleware? Please elaborate this in more details.

Hi @Rocky , Canton nodes can either store the keys locally or use envelope encryption to add security via a KMS system. Details here.