Key Management and Self-Custody Quickstart 2.3A.1-2

Why Keys Are Moral Architecture

A key — whether a password, a passkey, a cryptographic private key, or a recovery seed — is the structural mechanism through which you control access to your own identity, assets, and communications. Whoever holds your keys holds your sovereignty. This is not metaphor. A person whose email password is compromised has lost control of their identity verification chain. A person whose financial credentials are held by an institution they cannot audit has delegated custody of their economic agency. A person whose communication encryption keys are managed by a service provider has transferred the structural precondition of private thought to a third party.

Self-custody means maintaining sovereign control over critical access mechanisms rather than delegating that control to institutions whose incentive structures, governance, and continuity you cannot verify. This is the individual-level expression of bounded interdependence (1.2.6): participation in digital systems is not voluntary if the participant cannot exit without losing access to their own identity, credentials, and history.

The Four Practices

Practice 1 — Inventory. List every system through which you access consequential functions: email, banking, health records, professional credentials, communication channels, cloud storage, social accounts. For each, identify: who holds the authentication credentials? Who can reset them? What happens if the service is discontinued? The inventory makes dependency visible. Most people discover their access architecture has more single points of failure than they assumed.

Practice 2 — Credential Hygiene. For each system in the inventory, apply minimum structural standards: unique passwords managed through an encrypted password manager; two-factor authentication using a hardware key or authenticator app (not SMS, which is vulnerable to SIM-swap attacks); passkeys where supported as a phishing-resistant alternative. These are not convenience features. They are structural defenses against the most common attack vectors for identity compromise.

Practice 3 — Custody Assessment. For each critical system, ask: am I the custodian, or is an institution the custodian? Where an institution holds custody — of financial assets, of credentials, of data — assess the institution against three criteria: can I verify its governance? Can I exit with my assets and data intact? Is there a structural mechanism (not merely a policy) that prevents the institution from altering the terms of custody unilaterally? Where the answers are unsatisfactory, the dependency is a structural risk — not necessarily one that requires immediate action, but one that belongs on the assumptions register (from the article) as a managed exposure.

Practice 4 — Recovery Architecture. Design for the failure of any single component. The recovery architecture has three elements: backup credentials stored in at least two independent locations (one digital, one physical — a hardware key and a printed recovery sheet, for example); social recovery contacts — two or three trusted persons briefed on the recovery process and holding partial access to recovery mechanisms (not full access to any single system); and incident drills conducted at least annually, in which you simulate the loss of your primary device and execute the recovery plan under realistic conditions.

What Self-Custody Does Not Require

Self-custody does not require that you hold direct cryptographic control over every asset, host your own email server, or operate entirely outside institutional systems. That standard would be impractical for most people and unnecessary for the structural purpose self-custody serves.

What it requires is awareness and optionality. Awareness: you know who holds custody, what terms govern that custody, and what your exposure is if those terms change. Optionality: you have the structural capacity to migrate — to move your data, your credentials, and your access to alternative systems without prohibitive cost or loss.

The standard is not autarky. It is the structural absence of lock-in. A person who depends on a single institution for email, credentials, storage, and financial access — and who cannot migrate any of these without catastrophic cost — has not preserved the independence that Arc 1 taught and Arc 2 disciplined. Self-custody restores it at the infrastructure level.