Keywarden, the offline license-key warden

Field notes

Keywarden separates entitlement issuance from entitlement checking: the service signs a bundle, while the client verifies it locally using a pinned ECDSA P-256 public key. The page also describes operational details often omitted from licensing pitches, including background polling of voided purchases, floating seats that expire after a heartbeat TTL, and a 30-day safeguard before a used signing key can be retired. A CLI and documented management API cover app, device, license, and audit-log administration.