Cardano SPO Voting Still Relies on Cold Keys

Two Cardano governance actions expiring on September 1 have returned attention to the operational burden placed on stake pool operators. The Constitutional Committee update and a parameter action lowering minPoolCost from 170 to 75 ADA both require support from more than 51% of active SPO stake.

As of August 25, SPO support stood at 12% for the committee update and 16.9% for the parameter action.

SPO Votes Require an Offline Signing Workflow

Cardano’s current governance process requires an SPO vote to be created with the pool’s cold verification key and signed with its corresponding signing key.

According to the Cardano Developer Portal, the signing credential should remain on an air-gapped machine and never be transferred to an internet-connected device.

The operator must prepare the required files, move the unsigned transaction to the offline environment, sign it and return the completed transaction to an online machine for submission. The network fee is usually around 0.2 ADA, meaning cost is not the main obstacle. The larger issue is the need to access and handle a credential that protects the pool’s core identity.

Operators can include multiple vote files in the same transaction, allowing them to vote on both active actions through one signing procedure. This reduces the number of offline interactions but does not remove the security-sensitive workflow.

Abstaining by taking no action is also not always neutral. For many governance actions, an SPO’s active stake remains part of the denominator unless the pool is explicitly configured to abstain. Hard-fork votes still require a direct SPO vote.

Calidus Separates Identity From Pool Control

CIP-0151 introduced Calidus as an authorized hot key that can represent a stake pool without repeatedly exposing its primary credential. The authorization is registered on-chain and approved by the pool’s cold key.

A Calidus key can be used by governance tools, explorers and decentralized applications to verify that a message or action originates from the recognized pool operator. Because it is replaceable, a compromised key can be superseded through a new registration with a higher nonce. Operators can also revoke the authorization by registering a blank key.

This creates a security layer between routine application activity and the credential controlling the pool. The cold key is used to establish authorization, while the replaceable Calidus key handles lower-risk interactions.

However, that authorization currently applies to identity and application-level messages. It does not allow a Calidus key to sign a ledger-valid SPO governance vote.

Ledger Voting Support Is Not Yet Active

A proposal to extend Calidus into protocol voting was presented to the Intersect Civics Committee on June 11, 2026. The aim was to let SPOs vote through derived credentials instead of directly using the security hardware holding their primary signing key.

The committee considered formally endorsing ledger-level integration on June 25, but the vote was deferred because members requested additional time. Publicly available minutes reviewed for this article do not document a later decision that changed this status.

Committee support alone would not activate the feature. Calidus voting would still require a technical specification, ledger implementation, testing and an agreed protocol activation path.

The low voting percentages cannot be attributed exclusively to key management. Disagreement with a proposal, inactive pools and delegation choices also affect participation. Nevertheless, the current process creates additional operational work whenever an SPO decides to vote.

Until Calidus or another delegated authorization method becomes valid at the ledger level, operators who want their stake counted on the September 1 actions must complete the existing offline signing workflow with the credential that secures their pool.