Hey! was wondering does infisical offer infrastructure for storing PrivateKeys and remote signing ? we are moving all our env/secrets to infisical . but wanted something specific for PKs.

Hey! We do. Infisical supports both private key storage and remote signing through two product surfaces: 1. Infisical KMS (Sign/Verify keys) You can create asymmetric keys (RSA or ECDSA) with

Sign/Verify

key usage. Private keys are managed server-side — signing operations happen via API and keys never need to leave Infisical. Supports RSA-PSS, PKCS1v1.5, and ECDSA with SHA-256/384/512. You can also export the private key if needed, but the primary model is remote signing where the key stays in Infisical. Docs: https://infisical.com/docs/documentation/platform/kms 2. PKI Code Signing If you specifically need to sign software artifacts (binaries, container images, packages, etc.), we have a dedicated code signing workflow built on top of our PKI/Certificate Management product. You create a "Signer" — a named code-signing identity bound to a certificate. Private keys never leave the server; you send data in, get a signature back. This also includes: • Signing policies with approval workflows • Time/count-limited signing grants • A PKCS#11 module that plugs into standard tools (jarsigner, openssl, cosign, osslsigncode, apksigner, gpg) with zero code changes • Full audit trail of every signing operation Docs: https://infisical.com/docs/documentation/platform/pki/concepts/code-signing For general-purpose private key storage + remote signing → KMS. For code signing specifically with approval workflows and toolchain integration → PKI Code Signing. Let me know if you have any questions!

Hi Piyush! We will look into getting that added as soon as possible. Thanks!