feat(keychain): add access key signing support

[gakonst]

Summary

Adds access key (Keychain) signing support to tempo-go, enabling transactions to be signed by delegated access keys on behalf of root accounts.

Motivation

Access keys allow a secondary signing key to sign transactions on behalf of a root account, with optional spending limits and expiry. This is essential for:

• Delegated signing without passkey prompts on every transaction
• Scoped permissions with per-token spending limits
• Session keys for dApps

Changes

New pkg/keychain package

• SignWithAccessKey(tx, accessKeySigner, rootAccount): Sign a transaction using an access key
• BuildKeychainSignature(innerSig, rootAccount): Create 86-byte Keychain signature
• ParseKeychainSignature(sig): Parse signature into components
• VerifyAccessKeySignature(tx): Recover access key and root account addresses
• Helper functions for AccountKeychain precompile interaction

Signature Format

Per Tempo spec, Keychain signatures are 86 bytes:

0x03 || root_account (20 bytes) || inner_signature (65 bytes)

Where:

• 0x03 is the Keychain signature type identifier
• root_account is the account the access key acts on behalf of
• inner_signature is the secp256k1 signature from the access key (r || s || v)

Other Changes

• pkg/signer/signer.go: Add Raw field to SignatureEnvelope for keychain signatures
• pkg/transaction/serialize.go: Handle keychain signature serialization

Usage

import "github.com/tempoxyz/tempo-go/pkg/keychain"

// Create transaction
tx := transaction.New()
tx.ChainID = big.NewInt(42431)
tx.Calls = []transaction.Call{{To: &recipient, Value: big.NewInt(1000000)}}

// Sign with access key instead of root key
accessKeySigner, _ := signer.NewSigner(accessKeyPrivateKey)
err := keychain.SignWithAccessKey(tx, accessKeySigner, rootAccount)

Testing

All 10 unit tests pass:

go test ./pkg/keychain/... -v
=== RUN   TestBuildKeychainSignature
--- PASS: TestBuildKeychainSignature
=== RUN   TestParseKeychainSignature
--- PASS: TestParseKeychainSignature
=== RUN   TestSignWithAccessKey
--- PASS: TestSignWithAccessKey
=== RUN   TestVerifyAccessKeySignature
--- PASS: TestVerifyAccessKeySignature
...

References

• AccountKeychain Precompile Spec
• pytempo implementation: pytempo/keychain.py
• tempo-foundry implementation: crates/cast/src/tempo.rs

[brendanjryan]

LGTM!

[brendanjryan]

👍