Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture

An academic paper has introduced a zero-trust architecture aimed at enhancing AI agent signing workflows, tackling the significant risk posed by private keys that are accessible through software. This document, found on arXiv (2608.06130), details a real-world incident in which private keys were extracted from a commonly used framework via email injection in less than five minutes. The suggested approach substitutes software-based keys with hardware-secured keys, accessed through a vendor-agnostic PKCS#11 interface, thereby maintaining key confidentiality and enabling content-aware authorization. Cryptographic tasks are performed on-device by hardware keystores like HSMs, TPMs, and smart cards, providing only opaque handles to the host. The architecture is structured around a five-layer Zero-Trust model, with hardware confinement as its key innovation, significantly enhancing AI security by reducing the likelihood of key extraction by malicious entities.