PoS validator consensus key change

[tzemanovic]

Add a tx and update PoS validity predicate to allow validators to change consensus key

NOTE: how do we update this in tendermint? We currently using the key file on disk. The key change on-chain will happen in a future epoch, so we'd need to update the file at the right time.

┆Issue is synchronized with this Asana task by Unito

[tzemanovic]

NOTE: how do we update this in tendermint? We currently using the key file on disk. The key change on-chain will happen in a future epoch, so we'd need to update the file at the right time.

We can most likely use the same approach that is being developed for DKG integration, in which validators can change their PVSS public keys and the node waits for the txs to be applied before updating to the new key.

Additionally, we'll probably need to restart Tendermint after we update the priv_validator_key.json (I'm not sure if restarting it will be necessary with tendermint KMS).

[cwgoes]

@tzemanovic @brentstone do you know the status of this? we do need key rotation for mainnet. also, validators should be able to control this with their multisignature accounts.

[tzemanovic]

@tzemanovic @brentstone do you know the status of this? we do need key rotation for mainnet. also, validators should be able to control this with their multisignature accounts.

we don't have this - I think changing consensus key itself should be pretty straight-forward, restarting tendermint at the right time might be finicky, but hopefully we can automate it

[cwgoes]

We shouldn't need to restart Tendermint at all - just pass a different key in the validator set changes.

[tzemanovic]

We shouldn't need to restart Tendermint at all - just pass a different key in the validator set changes.

I'm not sure how this will work with KSM (#67), but without it, the consensus key is in a file in tendermint's dir. Because of the pipeline offset used when you change your consensus key, we need to switch the key in at the right time and I think this does necessitate TM restart, but I'm not 100% sure about it

[cwgoes]

Ah, I see - having the validator who is changing their key restart Tendermint makes sense, yeah. This can even be manual, though, we don't need to do it automatically. Usually keys will be rotated when a validator loses their key / thinks it might be compromised / etc.