Remote signing best practices

Choose and defend a signing architecture: placement, transport, key separation, and the one-signer rule.