Keys used for hardware-verified security are intended to be generated and protected in hardware-backed environments associated with the active form factor—card historically; SIM, eSIM or iSIM currently per company declaration. Exact generation location, custody model and export policy per deployment remain editorial tasks until engineering publishes confirmed details. This answer does not invent algorithms or key sizes.
Organizational key control is a program design choice across enterprise, bank, government or telco custody models. Keyra documentation must state which models are supported, proposed or unavailable. Historical Cyber One workforce themes suggest enterprise relevance, but current supported custody options require confirmed product evidence before claiming full customer key control.
Changing form factor typically requires separate enrollment of hardware-protected keys rather than casually exporting private keys. Whether regeneration, controlled migration or dual enrollment is supported is deployment-specific and not asserted here without engineering confirmation. Export policy cells remain editorial_task in the hardware matrix.
A trust root or trust anchor is the reference material a verifier uses to validate cryptographic evidence from a client or device. Public Keyra technology messaging describes SIM as a trust-anchor theme. Operational trust-store management belongs to platform operators and application publisher configuration.
