> For the complete documentation index, see [llms.txt](https://canary-1.gitbook.io/canary/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://canary-1.gitbook.io/canary/how-it-works/keys-signing-and-refusal.md).

# Keys, signing and refusal

What a refusal is, mechanically, and why it cannot be overridden at runtime.

Signing keys are generated inside the enclave, hardware-managed and never exported. Sensitive material lives in guarded memory containers, and any memory segment that temporarily holds key material is zeroed as soon as it is consumed. A signature can only be produced by attested code that has completed the full verification path.

## What a refusal is

A refusal is the absence of that signature. For Canary DVN, the message does not reach quorum on the affected pathway and nothing settles. For Canary Cosigner configured as a required approver, the issuer's quorum cannot complete and the mint or redemption does not execute.

A refusal is not a failure state that someone has to clear before business resumes. It is the system doing what it was built to do when correctness cannot be established.

## What cannot override it

On the DVN and Cipher path there is no override console, no manual approve button and no runtime flag that relaxes policy, because policy is sealed into the enclave image at deploy time. Cipher's manual approval control works in one direction only. It can add a required signature from the protocol's own key, and it can never remove a check. Changing policy is a deployment, not a toggle, and a deployment produces a new attestation measurement that anyone verifying the attestation can see.

Canary Cosigner adds a third outcome, the hold, for requests that need further checks and review before any signature exists. Holds are described on [Cosigner verification flow](/canary/how-it-works/cosigner-verification-flow.md).

## What can resolve it

A refusal resolves when its cause does. Sources come back into agreement, reserves are restored above threshold, or a protocol's own check returns a proven yes. For reserve accounting, transfers resume only once the invariant is restored, without a governance vote and without manual intervention.

## Refusals are recorded

Refusal is not silent. When Canary declines to sign, that fact and its reason are recorded rather than buried, because a verification layer that refuses is only credible if its refusals are auditable. See [Refusal transparency](/canary/trust-and-transparency/refusal-transparency.md).