Generation of signing keys

A computing system comprising:

• an apparatus to add approver devices to a command authorisation protocol;
• a set of first approver devices;
• and
• a further approver device;
• wherein the apparatus is to:
• provision each of t first partial signing keys to the set of first approver devices, wherein t corresponds to a threshold number of a threshold scheme and wherein t is a non-zero integer and provision a first public key related to the first partial signing keys to the set of first approver devices;
• receive a request to execute a first management command and relay the request to the set of first approver devices;
• receive, responsive to the relayed request, a threshold number of different first partial signatures produced using the first partial signing keys, indicating approval for execution of the first management command, the execution to be performed when the threshold number of different first partial signatures is combined to generate a complete signature;
• and
• provision a further partial signing key to a further approver device, a further partial signature produced using the further partial signing key being combinable with any combination of (t−1) of the first partial signatures to generate a further complete signature verifiable using the first public key to authorise execution of a second management command.

A non-transitory computer-readable storage medium comprising instructions that when executed cause processing circuitry of a computing device to:

• provision a first public key and a first plurality of partial signing keys of a first coding scheme to a set of first approver devices, the first plurality of partial signing keys having been generated in accordance with a threshold coding scheme;
• receive a request to execute a command and forward the request to the set of first approver devices;
• receive, responsive to the forwarded request, a threshold number of distinct partial signatures indicating approval for execution of the command, the approval to be verified by combining of the threshold number of different partial signatures keys to generate a complete signature;
• and
• provision, following execution of the approved command, a further partial signing key to a further approver device, the further partial signing key being associated with the first coding scheme and the first public key.