Skip to main content
Current release: v0.19.0. The offline signer is the air-gapped signing application behind an out-of-band key store: DFNS builds the unsigned transaction, the signature is produced on the offline signer, and the signed transaction is broadcast later. Setting one up is coordinated with DFNS. This is the first release tracked in this changelog; earlier versions predate it.
​
New FeatureSecurity
Week of October 5th, 2026New Feature:
  • Version waterlines across fleet operations. The offline signer enforces a minimum version across a fleet and refuses an operation that would mix incompatible versions (initial setup, device cloning, operator enrollment), with an actionable message naming the upgrade needed, so an operation can’t proceed from a stale binary.
  • Dedicated production provisioning tokens. Production provisioning requires a production-only token, keeping test provisioning credentials out of production fleets.
  • The application now ships as OfflineSigner (the beta naming is retired).
Security:
  • Device and key attestation on supported hardware: the offline signer verifies a signing key was generated on the device (firmware-enforced) and trusts the current YubiHSM attestation hierarchy.
  • Governance-gated bootstrap. Bootstrap imports are gated on governance, bootstrap mutation boundaries are hardened, and operational registration is bound to the provisioning device.
  • Hardened enrollment transport. The legacy symmetric transport is retired in favor of envelope-wrapped key transport, and stale transport keys are removed once a device is enrolled.
Last modified on November 10, 2026