---
title: "Discussion on \"Signing Mesh Tokens with Vault\" | Hashnode"
description: "Discussion on \"Signing Mesh Tokens with Vault\". Why the private signing key stays in Vault, how rotation avoids 403s, and the blast radius when a component is compromised"
url: "https://hashnode.com/posts/vault-transit-signing/6a4f6daec69db835216e1d31"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Signing Mesh Tokens with Vault](https://blogs.kaustavsarkar.dev/vault-transit-signing?utm_source=hashnode&utm_medium=feed)

Why the private signing key stays in Vault, how rotation avoids 403s, and the blast radius when a component is compromised

Jul 9 · 13 min read · blogs.kaustavsarkar.dev  
Read the article

-   [#istio](https://hashnode.com/tag/istio)
-   [#authentication](https://hashnode.com/tag/authentication)
-   [#vault](https://hashnode.com/tag/vault)
-   [#encryption](https://hashnode.com/tag/encryption)
-   [#kubernetes](https://hashnode.com/tag/kubernetes)
-   [#zerotrust](https://hashnode.com/tag/zerotrust)
-   [#zero-trust](https://hashnode.com/tag/zero-trust)
-   [#jwt](https://hashnode.com/tag/jwt)

## Written by

[Kaustav Sarkar](https://hashnode.com/@kaustavsarkar)

@kaustavsarkar · Bengaluru

  
[View profile](https://hashnode.com/@kaustavsarkar)

SDE Cloudera

I write about any technical topic that catches my interest. With AI writing most of the code today, I believe understanding the why is more important than it has ever been. This blog is a sneak peek into the messy mind of an engineer who is trying to figure out the how and why.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.