Summary

Currently, we use a raw tcp connection with a secret handshake between a HSM and a tendermint node for signing capabilities. This works but is a bit complicated for clients to implement when users would like to create a new HSM.

Proposal

With the migration of the Tendermint codebase to protobuf there is the possibility of simplifying the privval server by using gRPC. SSL/TLS authentication can be used. example: Go

if this is accepted then it would be good to get it in 0.34 and coordinate with the iqlusioninc around updating the kms.

ref: #2830

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned