Web3Signer
Web3Signer is an open-source Ethereum remote signing service developed under the Apache 2.0 license and written in Java. It signs consensus layer payloads with BLS12-381 keys and execution layer payloads with secp256k1 keys. Keep signing keys in files or in an external vault, as described in Store signing keys.
Why use Web3Signer
A consensus layer validator client, or an execution layer client, needs signatures to carry out its work. Web3Signer holds the signing keys and returns the signature. The client doesn't hold the keys, so the client and the machine it runs on operate at a lower level of trust than the signer. A fault in the client can't expose keys the client doesn't hold. If you operate the client, you don't need access to the Web3Signer host. Restrict access to the Web3Signer host separately. Add or replace a validator client without copying signing keys onto that client.
When to use Web3Signer
Use Web3Signer when you are a staking provider or an institutional staker, or when you have a large stake, many keys on a shared signer, keys in a vault, or an isolation requirement of your own. Use it as a remote signer in distributed validator technology (DVT), such as Obol and SSV Network.