digital-signature peripheral
A unit inside some ESP32s that signs with a key the CPU never sees.
The ESP32-S3/C6 DS peripheral computes RSA signatures with a private key stored encrypted under an eFuse-derived key, so the key can be used but not read or cloned.
Examples
On the ESP32-S3 and ESP32-C6, the DS peripheral signs a mutual-TLS handshake with an RSA key the CPU never sees.
A flash dump from a node using the DS peripheral yields only the encrypted key blob, which can't be decrypted off the chip.