Securing Institutional Digital Asset Custody: Private Keys, Distributed Trust, and the Uncomfortable Arrival of Quantum Computing

Institutional digital asset custody distributes cryptographic signing, transaction approval, operational state, and recovery across components whose security assumptions may not compose. This paper asks what remains enforceable when those trust domains fail independently and how the resulting architecture should evolve under a quantum threat to ECDSA. A revision pinned analysis of Quorum Custody is combined with 26 repeated unit tests, an executable divergent ledger model, unmodified recovery function experiments, and a local Ethereum transaction tested after approval expiry. The application broadcast validator rejected expired authorization while Anvil accepted the persisted ordinary transaction directly. Recovery rejected stale state against a retained checkpoint but accepted joint rollback of state and checkpoint under an explicitly privileged attacker. These findings illustrate known authority and state boundaries; they are not new cryptographic attacks or full MPC integration results. A local JavaScript verification benchmark measures selected ML-DSA, SLH-DSA, and hybrid configurations without inferring EVM gas or production performance. The paper contributes an evidence classified custody threat matrix and a staged migration proposal that covers spending, upgrades, recovery, and cryptographic agility. Native failure experiments and independent domain recovery remain unexecuted. The analysis supports conditional security claims tied to specific enforcement boundaries rather than a general claim of production readiness.