Canton RWA

RWA issuance, transfer, wallet architecture, and secure signing

Canton Network engineering at TEKHQS for an RWA platform, covering Daml contracts, non-custodial wallet architecture, threshold signing, and secure remote signing infrastructure. Client and project details are withheld.

RWACantonDamlSigning

The system

Daml application flows for RWA issuance and transfer, including external-party authorization and interactive submission. Non-custodial wallet architecture isolated from host applications. 2-of-3 threshold signing, with remote signing protected by AWS Nitro enclaves and KMS. A participant SDK for party management, RWA writes, and Canton submission. Participant configuration, DAR deployment, and environment topology as part of the same delivery.

The problem

Tokenizing real-world assets on a privacy-preserving ledger is not a single token contract. Issuance, transfer, and compliance have to survive explicit counterparties, multi-party authorization, and a signing model that is not a custodial hot wallet.

Context

I worked on Canton Network engineering as part of TEKHQS client delivery. TEKHQS was the employer. Client and project details are withheld.

Role

Architecture Owner & Engineering Lead.

What I architected

RWA contract architecture and Daml application flows for issuance and transfer.
External-party authorization and secure transaction submission.
Non-custodial wallet architecture and 2-of-3 threshold signing.
Secure remote signing, including AWS Nitro enclave architecture and KMS-backed key protection.
Participant SDK architecture, Canton participant configuration, DAR deployment, and environment topology.

Engineering decisions

Isolate the wallet origin from the host application so secret material does not cross that boundary.
Co-sign inside an attested enclave rather than in the browser or an unattested backend.
Decompose mixed external and internal authorization into single-authorizer legs when the ledger requires it.

Security

Threshold signing for external parties rather than a single-operator key.
Remote signing gated on enclave attestation and KMS-backed key protection.
Interactive submission for external-party authorization.

Result

Internal RWA issuance and transfer on Canton, including mint, transfer, enrollment, and the signing path. No public demo is claimed.

Infrastructure

Canton participant configuration and DAR deployment across local, stage, and production-shaped environments. Signing infrastructure on AWS Nitro enclaves with KMS-backed key protection.

Stack

Canton Network · Daml · TypeScript · AWS Nitro · KMS · WebAuthn

Evidence / Availability

Professional engineering work at TEKHQS. Client and proprietary implementation details withheld.

Client/internal project — implementation details are intentionally limited.

← All engineering work