How Danggeun built a large-scale signing key management system with AWS CloudHSM – Part 1: The importance of signing key security and service selection

Carrot, a major Korean local-community service, redesigned its signing-key management for a high-volume authentication system that handles about 65 million JWT signatures per day.

The team concluded that storing private keys in extractable form was too risky and moved to a hardware-backed design.

After evaluating AWS KMS and AWS CloudHSM, Carrot chose a hybrid architecture that keeps keys protected in HSMs while enabling tightly controlled, high-throughput signing.

The case highlights how weak key storage can undermine authentication and how hardware-backed isolation improves security and resilience at scale.