Yan, Shaopu

Add initial eHSM-KMS support for signstore

6

eHSM-KMS is An End-to-End Distributed and Scalable Cloud KMS built on top of Intel SGX enclave-based HSM(Hardware Security Module), aka eHSM. More details, please refer to: https://github.com/intel/ehsm

Support eHSM as an alternative KMS solution

1

Dear maintainers, We've developed an SGX-based Cloud KMS (called as eHSM), eHSM is a cloud service to provide functionalities to manage keys and secrets by fully leveraging Intel SGX capability....

according to the cloud kms, the digest need to be hashed by the user, so the sign operation may not need to hash it again. e.g, ecc/rsa/sm2

cmk will need to be upgraded or maybe expired, so need to consider to support its rotation in future.

attach the attestation token into the request params to assure the kms is actually run in the enclave.