> 3. Storing private keys in the cloud -- scary. Why do you need to do that? Isn't it enough to sign a transaction that includes the customer's (public) id, us

> 3. Storing private keys in the cloud -- scary. Why do you need to do that? Isn't it enough to sign a transaction that includes the customer's (public) id, using your own private key (which does not need to be different for different customers)? Either way, your service is "giving its word" that this transaction was authorized by the person with the given id; but this way there is one less security risk. Disclaimer: I do not work in this space.