Revert network key encryption, fix findings in original code

[nkryuchkov]

Summary

Revert #2765 and #2838.

Why

We decided to move persisted P2P network key encryption to a future release to reduce rollout risk.

#2838 was a temporary rollback bridge that downgraded already-migrated stage DBs back to plaintext. Now that it has been deployed, we can remove both:

• the original encrypted-storage change from #2765
• the temporary plaintext-rollback bridge from #2838

What changed

• revert persisted P2P network key encryption
• revert remote/local network-key protection wiring
• revert the temporary downgrade-to-plaintext bridge
• restore the previous plaintext-only persisted P2P key behavior
• keep current stage changes unrelated to #2765 and #2838
• fix two revert regressions in identity/store.go:
  • return DB errors before treating the key as missing
  • return decode errors before touching pk.Curve
• restore the malformed-ciphertext guard in ssvsigner/ekm/signer_storage.go to <= nonceSize

Testing

• go test ./identity ./cli/operator
• go test ./ekm in ssvsigner/
• make golangci-lint
• make deadcode-lint

[codecov]

Codecov Report

❌ Patch coverage is 59.61538% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.1%. Comparing base (ad30007) to head (c569f1b).
⚠️ Report is 40 commits behind head on stage.

Files with missing lines	Patch %	Lines
ssvsigner/ekm/signer_storage.go	52.0%	6 Missing and 6 partials ⚠️
identity/store.go	73.6%	3 Missing and 2 partials ⚠️
cli/operator/node.go	0.0%	4 Missing ⚠️

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[greptile-apps]

Greptile Summary

This PR reverts the persisted P2P network key encryption from PRs #2765 and #2838, restoring plaintext-only key storage to reduce rollout risk. The rollback bridge (#2838) was deployed first to downgrade already-migrated databases, so this final revert safely removes all encryption wiring.

• identity/store.go: Removes unprotectFn, encryptedPrefix, HasEncryptedNetworkKey, and decodeNetworkKey; reverts GetNetworkKey/SetupNetworkKey signatures to drop context.Context; adds a targeted test for corrupt-key error handling.
• ssvsigner/server.go / client.go: Removes /v1/operator/encrypt and /v1/operator/decrypt endpoints, renames handleOperatorSign → handleSignOperator and opOperatorSign → opSignOperator for consistency.
• ssvsigner/ekm/signer_storage.go: Inlines the deleted keys/aes.go AES-GCM helpers as private methods, preserving identical encrypt/decrypt behavior while removing the shared-package dependency.

Confidence Score: 5/5

Safe to merge — this is a targeted revert to plaintext-only P2P key storage, with the bridging migration already deployed on stage.

The change removes well-scoped encryption wiring (endpoints, identity store protection hooks, AES helpers) and restores the simple plaintext read/write path. Previously identified issues with nil-pointer ordering and silent DB error swallowing in identity/store.go have been properly addressed in this version. A repo-wide grep confirms no stale callers remain for any of the deleted symbols.

No files require special attention.

Important Files Changed

Filename	Overview
identity/store.go	Reverts to plaintext-only key storage; error guard correctly precedes pk.Curve assignment and DB errors are properly surfaced before the !found early return.
cli/operator/node.go	Removes decideNetworkKeyProtectors/probeRemoteNetworkKeyProtector; simplifies setupP2P signature to (logger, db) only — clean revert with no dangling references.
ssvsigner/ekm/signer_storage.go	Inlines AES-GCM encrypt/decrypt as private methods; logic is byte-for-byte identical to the deleted keys/aes.go; #nosec G407 annotation added to suppress known false positive.
ssvsigner/server.go	Removes /v1/operator/encrypt and /v1/operator/decrypt routes; renames handleOperatorSign → handleSignOperator consistent with observability.go constant rename.
ssvsigner/client.go	Removes OperatorEncrypt/OperatorDecrypt client methods and updates telemetry constant to opSignOperator; consistent with server-side rename.
ssvsigner/keys/aes.go	File deleted; its two AES-GCM helpers were only consumed by signer_storage.go, which now inlines them. No remaining callers in the repo.
ssvsigner/types.go	Removes ErrOperatorDataProtectionUnsupported sentinel; no callers remain after the cleanup of client.go and node.go.
ssvsigner/internal/mocks/mocks.go	Simplifies TestOperatorPublicKey and TestOperatorPrivateKey mocks by removing encrypt/decrypt function hooks that were only needed for the now-reverted endpoint tests.
go.mod	Reverts ssvsigner module pin from the April 2026 post-encryption version back to the October 2025 baseline.

Sequence Diagram

sequenceDiagram
    participant Node as SSV Node (startup)
    participant P2P as setupP2P()
    participant IS as identityStore
    participant DB as BadgerDB

    Node->>P2P: setupP2P(logger, db)
    P2P->>IS: NewIdentityStore(logger, db)
    P2P->>IS: SetupNetworkKey(skEncoded)
    IS->>DB: Get("p2p-", "private-key")
    alt Key found in DB
        DB-->>IS: (obj, true, nil)
        IS->>IS: decode(obj.Value) → gcrypto.ToECDSA
        IS-->>P2P: privateKey (plaintext)
    else No key in DB
        DB-->>IS: (_, false, nil)
        IS->>IS: ECDSAPrivateKey(skEncoded) — generate/parse
        IS->>DB: Set("p2p-", "private-key", gcrypto.FromECDSA(key))
        IS-->>P2P: privateKey (plaintext)
    end
    P2P-->>Node: P2PNetwork

Loading

_{Reviews (2): Last reviewed commit: "fix review comments" | Re-trigger Greptile}

[nkryuchkov]

@greptileai review this again

[iurii-ssv]

LGTM, safe to merge as revert has been applied across both stage & prod envs.

[momosh-ssv]

Hey, just to check something — was switching back to pkg/errors here intentional? #2825 just replaced it with stdlib repo-wide, and after this revert lands identity/store.go looks like the only file still importing github.com/pkg/errors (now // indirect in go.mod). Happy to keep it as faithful-revert if you'd rather, just figured worth flagging.

[github-actions]

This pull request has been marked as stale due to 60 days of inactivity. It will be closed in 30 days if there are no updates. Please comment if you would like to keep it open.