I'm currently working on a project that will implement multi-signature smart contracts to process our transactions. I have a quick question and am looking for input on how best to do this.
My team is working on a platform and for simplicity let's just say we have buyers and sellers, and all buyers and sellers have a registered account and stellar address/wallet on our platform.
We will create smart contracts that include the buyer, the seller, an escrow account, and us (in total 4 parties involved) which will be created for all payment scenarios (success, cancellation, refund, etc). Depending on which stage of the payment process we are on, each of the parties involved will have to sign and authorize the tx to go to the next step. And here is how I'm wondering what is the best way to do this?
We will need users to sign with their secret key, but also want to automate these contracts and make them easier. So instead of the buyer or seller having to input their secret key all the time to sign and authorize we would store the secret key encrypted on our platform and for example, if they click a button on our platform or advance/proceed with their transaction on our platform the smart contract will automatically be signed and then continue to the next step.
But this requires storing of all users' secret keys and I know many people will not be happy or trust this. I would also be wary about anyone claiming to store and encrypt your secret key, because we've all seen and heard about the various hacks happening all the time.
So my question is, how to make this safer and more trustable? Is there an easier way to automate a multi-signature smart contract without storing secret keys and requiring all parties to input their keys to proceed with the contract?