Two signatures, one height
Double-signing is the cardinal sin of proof-of-stake. Sign two different blocks at the same height and the network slashes your stake, and your delegators’.
Our remote signer holds the keys in a hardened HSM, separate from the validator host. Every sign request is checked against the highest height already signed; anything that would equivocate is denied before a signature is ever produced.
Why keys never touch the validator
If a validator node is compromised, the attacker still cannot sign on your behalf, the keys simply are not there. The signer is the only thing that can produce a signature, and it refuses to double-sign.