This path uses two short-lived keys and a passkey. Keplr does not.
- Base key — creates the on-chain account. It signs the one-time onboard message (HashMerchant covers the fee with a feegrant) that registers the custom authenticator. After that signature, this key is destroyed. It is not left in the browser.
- Browser key — a second secp256k1 key that stays in this tab. It is used together with your passkey in an AllOf authenticator. Day-to-day signing is passkey + this browser key, not the account’s original key.
Why two: smart-account auth can fall back to ordinary key signing. If the key left in the browser were the account’s default key and it leaked, the account would be compromised. So we never keep the default account key here.