BLS Key Generation (CRITICAL: Do Not Skip)

⛔ **WARNING:** Never reuse a BLS key across multiple nodes. Never store the BLS private key in plaintext. Never commit the .env file to version control. Loss of the BLS key means loss of your stake.

# Option A: Using RandProof CLI (recommended)
randproof wallet generate
# Output:
# Address: 0xYourKeeperAddress
# Private Key: 0xYourPrivateKey <- store in password manager
# Mnemonic: word1 word2 ... <- store offline, never digitally
# Option B: Using Cast (Foundry)
cast wallet new
# Fund the wallet with ETH for gas (Base mainnet: 0.005 ETH minimum)
# Send stake asset PLUS gas funds to this address before proceeding

# Generate BLS keypair for threshold signing (BN254 curve for EVM chains)
randproof bls generate --curve bn254 --output ./keys/bls-keystore.json
# You will be prompted for an encryption password:
# Enter BLS keystore password: ************
# Confirm password: ************
# Output:
# BLS Public Key: 0x1a2b3c... (register this on-chain)
# Keystore saved: ./keys/bls-keystore.json (encrypted)
# For non-EVM chains (BLS12-381 for Polkadot/Quicknet verification)
randproof bls generate --curve bls12-381 --output ./keys/bls-381-keystore.json
# Verify key integrity
randproof bls verify ./keys/bls-keystore.json
# Back up immediately (encrypted backup to secure location)
cp ./keys/bls-keystore.json ~/secure-backup/bls-keystore-$(date +%Y%m%d).json
⚠ ***NOTE:** Store your BLS keystore password in a separate location from the keystore file. A password manager (1Password, Bitwarden) is strongly recommended. The keystore file alone cannot be used without the password.*