Sign and decapsulate with post-quantum keys generated from your live biometric. Public keys are stored; private keys never are.
Stored private signing keys require protection throughout their lifecycle. SenseCrypt PKI removes the stored copy of the person’s operation key.
Face sign produces a signature that anyone holding the public key can verify. Encapsulation also uses the stored public key; face decapsulate generates the private key for that operation.
PKI: public and private key lifecycles
Explore the four stages.
The PKI operation first checks for a live person at capture, within the evaluated presentation-attack detection scope.
PKI lifecycle: generate the post-quantum key-pair in memory, use the private key for face sign or face decapsulate, then discard it.
Face sign generates its private key from a live biometric check at the moment of signing, and the signature and public key remain available for independent verification. Applications must bind the signed data to the intended approval or document; legal meaning depends on the deployment.
The split-verification design separates roles in establishing the enrolled person’s certificate. Public keys and certificates are retained; the CA’s issuer key has its own custody lifecycle.
Use stored PKI public keys with standard libraries supporting ML-DSA for signature verification and ML-KEM for encapsulation. Private-key face sign and face decapsulate use the biometric operation. IdP federation remains a separate integration.