Validator key separation: signer / operator / stash

[satyakwok]

Gap

Current code has a single Wallet struct (crates/sentrix-wallet/src/wallet.rs) used for both consensus signing AND general ops (transfers, governance, etc). A compromised operator key = compromised consensus key + full wallet drain.

Industry standard for L1 validators is multi-key:

• Consensus / signer key: signs BFT votes only. Hot, on validator host. Compromise = double-sign risk, mitigated by tombstone + rotation.
• Operator key: submits operational tx (Unjail, ClaimRewards, parameter updates). Warm.
• Stash / cold key: holds bonded SRX, signs Undelegate/Withdraw. Cold, ideally hardware wallet.

Decision was made 2026-04-21 to ship this, blocked behind mainnet stability work.

Acceptance criteria

• SIP drafted documenting key-separation model + rotation/recovery
• Wallet struct refactored into ConsensusKey + OperatorKey + StashKey
• RegisterValidator tx accepts consensus pubkey separately from sender (which is stash)
• Migration path for existing 4 validators (all on one-key)
• Testnet bake ≥1 week before mainnet activation

Blocker

Multi-week scope (design + code + migration + testing). Not closeable in a single session — needs SIP first.