Runs on your machine. Holds wallets in a KEK-encrypted keystore.
Signs in-process under hard, server-side limits.