Best Practices for Securing Secret Keys in a Tier-3 DLT App Built on Stellar

Question

I'm working on a Stellar-based app. Part of our protocol requires us to submit transactions from users accounts. We'd prefer to have users enter their secret keys when their accounts need to submit the transactions. Then we wouldn't need to store the secret keys. What would be the best way to securely pass the users secret key between the user, us, and Stellar? Is caching the key on the users device considered secure?

Alternatively, would it be considered more secure to have users set up accounts on our application that are associated with Stellar accounts that we store the secret keys for?

Answer 1

There is a catchphrase that says: Not your keys, not your coins. Private keys should only be known/managed/used by their owner and nobody else.

If you want it the trustless crypto way: Pass an unsigned transaction to the user, let them sign it with their private key (which you'll never have access to) and send the signed transaction back to you / or submit it directly to the network.