Key set

Not withdrawable from here

• Each key is minted on the server and sealed before it is stored, so the database holds nothing usable.
• A request is signed by whichever key is best funded, so one empty or lost key never stops the relayer.
• A key will only ever sign a pool withdrawal, or a gas top-up to that withdrawal’s own recipient — never a transfer out.