Does anyone else feel that voting on governance with our SPO cold keys is becoming increasingly unsafe, especially these days? We've been asking for SPO hot voting keys at the ledger level since the early days of SanchoNet, and we're still waiting. I'm not concerned about the cryptography of repeatedly signing with the cold key. The problem is the operational security around the signing process. Every governance vote currently requires us to move an unsigned transaction into the cold environment, typically using removable media such as a USB drive. That means the media used to cross the air gap becomes another security dependency. If that drive is ever compromised, tampered with, or replaced, it can potentially become a vector for malicious data entering the cold-signing environment. Of course, a properly designed cold-signing workflow should independently verify the transaction before signing.(Which we have and hopefully every SPO uses). But we're still unnecessarily introducing another component that has to be trusted and managed correctly every time we vote. With ledger-level SPO hot voting keys, governance could be completely separated from the pool's cold key. We could sign governance transactions in a hot environment, or use a separated signing environment, without repeatedly involving the pool's root cold key and the infrastructure used to transport transactions to it. Cold keys should be cold. The more routine governance becomes, the more important it is that voting doesn't require us to repeatedly cross the cold-security boundary.🧐🤌