ZeroKMS: keysets, clients, and key management

ZeroKMS is the key service behind every CipherStash Stack operation. This skill is the canonical description of its access model. Other skills (stash-edge, stash-deployment, stash-cli, stash-postgres, stash-supabase) touch credentials and keysets in passing; where their wording and this skill disagree, this skill wins.

Authentication and regions (see stash-auth)

ZeroKMS accepts exactly one credential: a CipherStash service token — a short-lived signed JWT minted by CTS, the CipherStash token service. Access keys and IdP JWTs are never sent to ZeroKMS directly; they are exchanged at CTS for a service token first. The auth strategies do this for you — stash-auth is the canonical skill for that whole surface (strategies, CS_* variables, token contents, failure codes).