The key vault is a station facility that makes key pairs and holds their private keys. With them it signs what its owner sends and opens what was sealed for them. Keys are game objects with rules, not real cryptography: a signature checks against its key by the rules of the Infonet, and nothing can forge one.
Key pairs
Making a key pair takes time and writes it onto a data core from the station's hold. The key gets a fingerprint, its public name, and a strength set by the vault. Its public key goes into its owner's keyring; its private key stays in the vault, up to the number the vault can hold. A key signs as whoever owned the vault when it was made, player or company, and says nothing about who controls a company.
Using keys
A key is used where it is held. Orders, messages and monitor reports are signed only while a working vault holding the key is linked to its owner's hull through the Infonet. Signing text and opening sealed messages and text are orders to the vault itself, which travel the Infonet like any order to its station.
Keys as items
A private key is physical data, the item key:<fingerprint>, as heavy as the data core it is written on. An order to the vault unloads one into its station's hold, to be carried and traded like any item, and another loads one from the hold. A loaded key signs and opens for the vault's owner, and its old signatures still check against the same public key.
A captured station's vault passes to the captor with its keys. A wrecked vault's keys survive in the wreck, and the wreck's last part gives them up to whoever salvages it.
Construction
It is built from processors, containers and frames. A relay or a Forward HQ can hold one. It draws power all the time, and while unpowered, or while its station is disabled, it signs and opens nothing.