NetworkKeyResolver

Produces the RSPM network-key: the value that links a proxy with its backends and namespaces the network's storage on the relay.

The proxy owns this value. It mints one with mint and hands it to backends. Floodgate is no longer consulted at runtime.

deriveFromFloodgateKey survives only as a one-time migration seed. Earlier versions derived the key by hashing Floodgate's key.pem, on the incorrect premise that Floodgate requires that file on every backend. It does not — Floodgate's own setup guide states you only need Floodgate on the proxy unless you want its API on backends. On that documented default topology the old scheme could never link, because backends silently generated a random key instead.

Seeding from key.pem on first boot keeps every already-working network on the identity it currently uses, so a proxy that upgrades before its backends stays linked to them mid-rollout. Once a component has persisted a key, this method is never called again, and the seed branch can be deleted outright in a later version.

Both forms are UUID-shaped so persisted keys from any era remain valid.