Enterprise Security, KMS & Persistence

With keys stored in the node's database (the default), what does the node identities dump contain?

• Only the party IDs and the node's public certificates
• The participant's private keys, so it must be stored like a secret
• Nothing sensitive; it is a list of package IDs

Envelope encryption is switched on. Where is the private key while the node is running?

• In the node's memory as plaintext, and encrypted in the database at rest
• Only inside the KMS, never in the node
• On the operator's laptop, loaded at start-up