diff --git a/infrastructure/control-panel/src/routes/+layout.svelte b/infrastructure/control-panel/src/routes/+layout.svelte
index bd77d4c40..bd6d767b8 100644
--- a/infrastructure/control-panel/src/routes/+layout.svelte
+++ b/infrastructure/control-panel/src/routes/+layout.svelte
@@ -15,12 +15,11 @@
 		{ label: 'Actions', href: '/actions' }
 	];
 
-	const isActive = (href: string) =>
-		href === '/' ? pageUrl === '/' : pageUrl.startsWith(href);
+	const isActive = (href: string) => (href === '/' ? pageUrl === '/' : pageUrl.startsWith(href));
 </script>
 
 <main class="flex min-h-screen bg-gray-50">
-	<aside class="w-64 border-black-100 border-r bg-white px-8 py-10">
+	<aside class="border-black-100 w-64 border-r bg-white px-8 py-10">
 		<h4 class="text-lg font-semibold text-black">Navigation</h4>
 		<nav class="mt-6 flex flex-col gap-2">
 			{#each navLinks as link}
diff --git a/infrastructure/control-panel/src/routes/actions/+page.svelte b/infrastructure/control-panel/src/routes/actions/+page.svelte
index e9e221706..dbe673371 100644
--- a/infrastructure/control-panel/src/routes/actions/+page.svelte
+++ b/infrastructure/control-panel/src/routes/actions/+page.svelte
@@ -67,10 +67,11 @@
 </script>
 
 <section class="max-w-3xl space-y-6">
-	<div class="rounded-2xl border border-black-100 bg-white px-8 py-6 shadow-sm">
+	<div class="border-black-100 rounded-2xl border bg-white px-8 py-6 shadow-sm">
 		<h2 class="text-2xl font-semibold text-black">Actions</h2>
-		<p class="mt-2 text-black-700">
-			Manual actions for orchestrating DreamSync. Trigger matchmaking directly from the control panel.
+		<p class="text-black-700 mt-2">
+			Manual actions for orchestrating DreamSync. Trigger matchmaking directly from the
+			control panel.
 		</p>
 
 		<div class="mt-6 space-y-4">
@@ -87,8 +88,9 @@
 					Trigger DreamSync
 				</ButtonAction>
 			</div>
-			<p class="text-sm text-black-500">
-				Note: Matchmaking can take up to 4 minutes to complete. Please wait for the process to finish.
+			<p class="text-black-500 text-sm">
+				Note: Matchmaking can take up to 4 minutes to complete. Please wait for the process
+				to finish.
 			</p>
 		</div>
 	</div>
@@ -96,7 +98,7 @@
 
 {#if toast}
 	<div
-		class={`fixed right-6 top-24 z-50 rounded-lg border px-4 py-3 shadow-lg ${
+		class={`fixed top-24 right-6 z-50 rounded-lg border px-4 py-3 shadow-lg ${
 			toast.variant === 'success'
 				? 'border-green-200 bg-green-100 text-green-800'
 				: 'border-danger-200 bg-danger-100 text-danger-500'
@@ -105,4 +107,3 @@
 		<p class="font-semibold">{toast.message}</p>
 	</div>
 {/if}
-
diff --git a/infrastructure/eid-wallet/package.json b/infrastructure/eid-wallet/package.json
index 5a441eb42..43757b491 100644
--- a/infrastructure/eid-wallet/package.json
+++ b/infrastructure/eid-wallet/package.json
@@ -42,6 +42,7 @@
         "graphql-request": "^6.1.0",
         "html5-qrcode": "^2.3.8",
         "import": "^0.0.6",
+        "jose": "^5.2.0",
         "svelte-loading-spinners": "^0.3.6",
         "svelte-qrcode": "^1.0.1",
         "tailwind-merge": "^3.0.2",
diff --git a/infrastructure/eid-wallet/src/lib/global/controllers/evault.ts b/infrastructure/eid-wallet/src/lib/global/controllers/evault.ts
index a506e3b0b..bc39e07df 100644
--- a/infrastructure/eid-wallet/src/lib/global/controllers/evault.ts
+++ b/infrastructure/eid-wallet/src/lib/global/controllers/evault.ts
@@ -6,6 +6,7 @@ import {
 import type { Store } from "@tauri-apps/plugin-store";
 import axios from "axios";
 import { GraphQLClient } from "graphql-request";
+import * as jose from "jose";
 import NotificationService from "../../services/NotificationService";
 import type { KeyService } from "./key";
 import type { UserController } from "./user";
@@ -122,22 +123,94 @@ export class VaultController {
                 },
             });
 
-            const existingPublicKey = whoisResponse.data?.publicKey;
-            if (existingPublicKey) {
-                // Public key already exists, mark as saved
-                localStorage.setItem(`publicKeySaved_${eName}`, "true");
-                console.log(`Public key already exists for ${eName}`);
-                return;
-            }
+            // Get key binding certificates array from whois response
+            const keyBindingCertificates =
+                whoisResponse.data?.keyBindingCertificates;
 
-            // Get public key using the exact same logic as onboarding/verification flow
-            // KEY_ID is always "default", context depends on whether user is pre-verification
+            // Get current device's public key to check if it already exists
             const KEY_ID = "default";
-
-            // Determine context: check if user is pre-verification (fake/demo user)
             const isFake = await this.#userController.isFake;
             const context = isFake ? "pre-verification" : "onboarding";
 
+            let currentPublicKey: string | undefined;
+            try {
+                currentPublicKey = await this.#keyService.getPublicKey(
+                    KEY_ID,
+                    context,
+                );
+            } catch (error) {
+                console.error(
+                    "Failed to get current public key for comparison:",
+                    error,
+                );
+                // Continue to sync anyway
+            }
+
+            // If we have certificates and current key, check if it already exists
+            if (
+                keyBindingCertificates &&
+                Array.isArray(keyBindingCertificates) &&
+                keyBindingCertificates.length > 0 &&
+                currentPublicKey
+            ) {
+                try {
+                    // Get registry JWKS for JWT verification
+                    const registryUrl = PUBLIC_REGISTRY_URL;
+                    if (registryUrl) {
+                        const jwksUrl = new URL(
+                            "/.well-known/jwks.json",
+                            registryUrl,
+                        ).toString();
+                        const jwksResponse = await axios.get(jwksUrl, {
+                            timeout: 10000,
+                        });
+                        const JWKS = jose.createLocalJWKSet(jwksResponse.data);
+
+                        // Extract public keys from certificates and check if current key exists
+                        for (const jwt of keyBindingCertificates) {
+                            try {
+                                const { payload } = await jose.jwtVerify(
+                                    jwt,
+                                    JWKS,
+                                );
+
+                                // Verify ename matches
+                                if (payload.ename !== eName) {
+                                    continue;
+                                }
+
+                                // Extract publicKey from JWT payload
+                                const extractedPublicKey =
+                                    payload.publicKey as string;
+                                if (extractedPublicKey === currentPublicKey) {
+                                    // Current device's key already exists, mark as saved
+                                    localStorage.setItem(
+                                        `publicKeySaved_${eName}`,
+                                        "true",
+                                    );
+                                    console.log(
+                                        `Public key already exists for ${eName}`,
+                                    );
+                                    return;
+                                }
+                            } catch (error) {
+                                // JWT verification failed, try next certificate
+                                console.warn(
+                                    "Failed to verify key binding certificate:",
+                                    error,
+                                );
+                            }
+                        }
+                    }
+                } catch (error) {
+                    console.error(
+                        "Error checking existing public keys:",
+                        error,
+                    );
+                    // Continue to sync anyway
+                }
+            }
+
             console.log("=".repeat(70));
             console.log("🔄 [VaultController] syncPublicKey called");
             console.log("=".repeat(70));
diff --git a/infrastructure/evault-core/src/core/db/db.service.ts b/infrastructure/evault-core/src/core/db/db.service.ts
index 5f3093a4d..454df1b46 100644
--- a/infrastructure/evault-core/src/core/db/db.service.ts
+++ b/infrastructure/evault-core/src/core/db/db.service.ts
@@ -676,43 +676,53 @@ export class DbService {
     }
 
     /**
-     * Gets the public key for a given eName.
+     * Gets all public keys for a given eName.
      * @param eName - The eName identifier
-     * @returns The public key string, or null if not found
+     * @returns Array of public key strings, or empty array if not found
      */
-    async getPublicKey(eName: string): Promise<string | null> {
+    async getPublicKeys(eName: string): Promise<string[]> {
         if (!eName) {
-            throw new Error("eName is required for getting public key");
+            throw new Error("eName is required for getting public keys");
         }
 
         const result = await this.runQueryInternal(
-            `MATCH (u:User { eName: $eName }) RETURN u.publicKey AS publicKey`,
+            `MATCH (u:User { eName: $eName }) RETURN u.publicKeys AS publicKeys`,
             { eName },
         );
 
         if (!result.records[0]) {
-            return null;
+            return [];
         }
 
-        return result.records[0].get("publicKey") || null;
+        const publicKeys = result.records[0].get("publicKeys");
+        // Handle null/undefined and ensure we return an array
+        if (!publicKeys || !Array.isArray(publicKeys)) {
+            return [];
+        }
+
+        return publicKeys;
     }
 
     /**
-     * Sets or updates the public key for a given eName.
+     * Adds a public key to the array for a given eName (appends, avoids duplicates).
      * @param eName - The eName identifier
-     * @param publicKey - The public key to store
+     * @param publicKey - The public key to add
      */
-    async setPublicKey(eName: string, publicKey: string): Promise<void> {
+    async addPublicKey(eName: string, publicKey: string): Promise<void> {
         if (!eName) {
-            throw new Error("eName is required for setting public key");
+            throw new Error("eName is required for adding public key");
         }
         if (!publicKey) {
             throw new Error("publicKey is required");
         }
 
+        // Use MERGE to create User if doesn't exist, then append publicKey if not already in array
         await this.runQueryInternal(
             `MERGE (u:User { eName: $eName })
-             SET u.publicKey = $publicKey`,
+             ON CREATE SET u.publicKeys = []
+             WITH u
+             WHERE NOT $publicKey IN u.publicKeys
+             SET u.publicKeys = u.publicKeys + $publicKey`,
             { eName, publicKey },
         );
     }
@@ -803,26 +813,26 @@ export class DbService {
             }
         }
 
-        // Copy User node with public key if it exists
+        // Copy User node with public keys if it exists
         try {
             const userResult = await this.runQueryInternal(
-                `MATCH (u:User { eName: $eName }) RETURN u.publicKey AS publicKey`,
+                `MATCH (u:User { eName: $eName }) RETURN u.publicKeys AS publicKeys`,
                 { eName },
             );
 
             if (userResult.records.length > 0) {
-                const publicKey = userResult.records[0].get("publicKey");
-                if (publicKey) {
+                const publicKeys = userResult.records[0].get("publicKeys");
+                if (publicKeys && Array.isArray(publicKeys) && publicKeys.length > 0) {
                     console.log(
-                        `[MIGRATION] Copying User node with public key for eName: ${eName}`,
+                        `[MIGRATION] Copying User node with public keys for eName: ${eName}`,
                     );
                     await targetDbService.runQuery(
                         `MERGE (u:User { eName: $eName })
-                         SET u.publicKey = $publicKey`,
-                        { eName, publicKey },
+                         SET u.publicKeys = $publicKeys`,
+                        { eName, publicKeys },
                     );
                     console.log(
-                        `[MIGRATION] User node with public key copied successfully`,
+                        `[MIGRATION] User node with public keys copied successfully`,
                     );
                 }
             }
diff --git a/infrastructure/evault-core/src/core/db/migrations/migrate-publickey-to-array.ts b/infrastructure/evault-core/src/core/db/migrations/migrate-publickey-to-array.ts
new file mode 100644
index 000000000..e2fc8e181
--- /dev/null
+++ b/infrastructure/evault-core/src/core/db/migrations/migrate-publickey-to-array.ts
@@ -0,0 +1,48 @@
+/**
+ * Neo4j Migration: Convert User.publicKey (string) to User.publicKeys (array)
+ * 
+ * This migration converts the single publicKey property to an array of publicKeys
+ * to support multiple device installs per user.
+ * 
+ * For existing users with publicKey: converts to [publicKey]
+ * For users without publicKey: initializes as []
+ */
+
+import { Driver } from "neo4j-driver";
+
+export async function migratePublicKeyToArray(driver: Driver): Promise<void> {
+    const session = driver.session();
+    try {
+        // First, convert existing publicKey (string) to publicKeys (array)
+        // For users with publicKey, set publicKeys = [publicKey] and remove publicKey
+        const result = await session.run(
+            `MATCH (u:User)
+             WHERE u.publicKey IS NOT NULL AND u.publicKeys IS NULL
+             SET u.publicKeys = [u.publicKey]
+             REMOVE u.publicKey
+             RETURN count(u) as converted`
+        );
+        
+        const converted = result.records[0]?.get("converted") || 0;
+        console.log(`Converted ${converted} User nodes from publicKey to publicKeys array`);
+
+        // For users without publicKey, initialize publicKeys as empty array
+        const result2 = await session.run(
+            `MATCH (u:User)
+             WHERE u.publicKey IS NULL AND u.publicKeys IS NULL
+             SET u.publicKeys = []
+             RETURN count(u) as initialized`
+        );
+        
+        const initialized = result2.records[0]?.get("initialized") || 0;
+        console.log(`Initialized ${initialized} User nodes with empty publicKeys array`);
+
+        console.log("Migration completed: publicKey -> publicKeys array");
+    } catch (error) {
+        console.error("Error migrating publicKey to publicKeys array:", error);
+        throw error;
+    } finally {
+        await session.close();
+    }
+}
+
diff --git a/infrastructure/evault-core/src/core/http/server.ts b/infrastructure/evault-core/src/core/http/server.ts
index 2ab81785c..9a5a72eeb 100644
--- a/infrastructure/evault-core/src/core/http/server.ts
+++ b/infrastructure/evault-core/src/core/http/server.ts
@@ -94,23 +94,65 @@ export async function registerHttpRoutes(
                     .send({ error: "X-ENAME header is required" });
             }
 
-            // Get public key from database if dbService is available
-            let publicKey: string | null = null;
+            // Get public keys from database if dbService is available
+            let publicKeys: string[] = [];
             if (dbService) {
                 try {
-                    publicKey = await dbService.getPublicKey(eName);
+                    publicKeys = await dbService.getPublicKeys(eName);
                 } catch (error) {
                     console.error(
-                        "Error getting public key from database:",
+                        "Error getting public keys from database:",
                         error,
                     );
-                    // Continue with null publicKey
+                    // Continue with empty array
+                }
+            }
+
+            // Generate key binding certificates for each public key
+            const keyBindingCertificates: string[] = [];
+            const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+            const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+
+            if (registryUrl && sharedSecret && publicKeys.length > 0) {
+                try {
+                    for (const publicKey of publicKeys) {
+                        try {
+                            const response = await axios.post(
+                                new URL("/key-binding-certificate", registryUrl).toString(),
+                                {
+                                    ename: eName,
+                                    publicKey: publicKey,
+                                },
+                                {
+                                    headers: {
+                                        Authorization: `Bearer ${sharedSecret}`,
+                                    },
+                                    timeout: 10000,
+                                }
+                            );
+                            if (response.data?.token) {
+                                keyBindingCertificates.push(response.data.token);
+                            }
+                        } catch (error) {
+                            console.error(
+                                `Error generating key binding certificate for public key:`,
+                                error,
+                            );
+                            // Continue with other keys even if one fails
+                        }
+                    }
+                } catch (error) {
+                    console.error(
+                        "Error generating key binding certificates:",
+                        error,
+                    );
+                    // Return empty array if generation fails
                 }
             }
 
             const result = {
                 w3id: eName,
-                publicKey: publicKey,
+                keyBindingCertificates: keyBindingCertificates,
             };
             console.log("Whois request:", result);
             return result;
@@ -447,18 +489,18 @@ export async function registerHttpRoutes(
             }
 
             try {
-                await dbService.setPublicKey(eName, publicKey);
+                await dbService.addPublicKey(eName, publicKey);
                 return {
                     success: true,
-                    message: "Public key saved successfully",
+                    message: "Public key added successfully",
                 };
             } catch (error) {
-                console.error("Error saving public key:", error);
+                console.error("Error adding public key:", error);
                 return reply.status(500).send({
                     error:
                         error instanceof Error
                             ? error.message
-                            : "Failed to save public key",
+                            : "Failed to add public key",
                 });
             }
         },
diff --git a/infrastructure/evault-core/src/index.ts b/infrastructure/evault-core/src/index.ts
index 96d8313f1..ca922f106 100644
--- a/infrastructure/evault-core/src/index.ts
+++ b/infrastructure/evault-core/src/index.ts
@@ -101,6 +101,14 @@ const initializeEVault = async (provisioningServiceInstance?: ProvisioningServic
         console.warn("Failed to create User index:", error);
     }
 
+    // Migrate publicKey (string) to publicKeys (array)
+    try {
+        const { migratePublicKeyToArray } = await import("./core/db/migrations/migrate-publickey-to-array");
+        await migratePublicKeyToArray(driver);
+    } catch (error) {
+        console.warn("Failed to migrate publicKey to publicKeys array:", error);
+    }
+
     const dbService = new DbService(driver);
     logService = new LogService(driver);
     const publicKey = process.env.EVAULT_PUBLIC_KEY || null;
diff --git a/infrastructure/signature-validator/package.json b/infrastructure/signature-validator/package.json
index 620fb2c60..3ad8ca8be 100644
--- a/infrastructure/signature-validator/package.json
+++ b/infrastructure/signature-validator/package.json
@@ -14,6 +14,7 @@
     },
     "dependencies": {
         "axios": "^1.6.7",
+        "jose": "^5.2.0",
         "multiformats": "^13.3.2"
     },
     "devDependencies": {
diff --git a/infrastructure/signature-validator/src/index.ts b/infrastructure/signature-validator/src/index.ts
index 952d7482c..c89702290 100644
--- a/infrastructure/signature-validator/src/index.ts
+++ b/infrastructure/signature-validator/src/index.ts
@@ -1,4 +1,5 @@
 import axios from "axios";
+import * as jose from "jose";
 
 // Lazy initialization for base58btc to handle ESM module resolution
 let base58btcModule: { base58btc: { decode: (input: string) => Uint8Array } } | null = null;
@@ -107,12 +108,12 @@ async function decodeSignature(signature: string): Promise<Uint8Array> {
 }
 
 /**
- * Retrieves the public key for a given eName
+ * Retrieves key binding certificates for a given eName
  * @param eName - The eName (W3ID) of the user
  * @param registryBaseUrl - Base URL of the registry service
- * @returns The public key in multibase format
+ * @returns Array of JWT tokens (key binding certificates)
  */
-async function getPublicKey(eName: string, registryBaseUrl: string): Promise<string | null> {
+async function getKeyBindingCertificates(eName: string, registryBaseUrl: string): Promise<string[]> {
   // Step 1: Resolve eVault URL from registry
   const resolveUrl = new URL(`/resolve?w3id=${encodeURIComponent(eName)}`, registryBaseUrl).toString();
   const resolveResponse = await axios.get(resolveUrl, {
@@ -125,7 +126,7 @@ async function getPublicKey(eName: string, registryBaseUrl: string): Promise<str
 
   const evaultUrl = resolveResponse.data.uri;
 
-  // Step 2: Get public key from eVault /whois endpoint
+  // Step 2: Get key binding certificates from eVault /whois endpoint
   const whoisUrl = new URL("/whois", evaultUrl).toString();
   const whoisResponse = await axios.get(whoisUrl, {
     headers: {
@@ -134,12 +135,12 @@ async function getPublicKey(eName: string, registryBaseUrl: string): Promise<str
     timeout: 10000,
   });
 
-  const publicKey = whoisResponse.data?.publicKey;
-  if (!publicKey) {
-    return null
+  const keyBindingCertificates = whoisResponse.data?.keyBindingCertificates;
+  if (!keyBindingCertificates || !Array.isArray(keyBindingCertificates)) {
+    return [];
   }
 
-  return publicKey;
+  return keyBindingCertificates;
 }
 
 /**
@@ -198,63 +199,104 @@ export async function verifySignature(
       };
     }
 
-    // Get public key from eVault
-    const publicKeyMultibase = await getPublicKey(eName, registryBaseUrl)
+    // Get key binding certificates from eVault
+    const keyBindingCertificates = await getKeyBindingCertificates(eName, registryBaseUrl);
 
-    if (!publicKeyMultibase) {
+    if (keyBindingCertificates.length === 0) {
       return {
         valid: true,
       };
     }
-    // Decode the public key
-    const publicKeyBytes = await decodeMultibasePublicKey(publicKeyMultibase);
-
-    // Import the public key for Web Crypto API
-    // The public key is in SPKI format (SubjectPublicKeyInfo)
-    // Create a new ArrayBuffer from the Uint8Array
-    const publicKeyBuffer = new Uint8Array(publicKeyBytes).buffer;
-    
-    let publicKey;
-    try {
-      publicKey = await crypto.subtle.importKey(
-        "spki",
-        publicKeyBuffer,
-        {
-          name: "ECDSA",
-          namedCurve: "P-256",
-        },
-        false,
-        ["verify"]
-      );
-    } catch (importError) {
-      console.error(`[DEBUG] Failed to import public key: ${importError instanceof Error ? importError.message : String(importError)}`);
-      throw importError;
-    }
 
-    // Decode the signature
-    const signatureBytes = await decodeSignature(signature);
+    // Get registry JWKS for JWT verification
+    const jwksUrl = new URL("/.well-known/jwks.json", registryBaseUrl).toString();
+    const jwksResponse = await axios.get(jwksUrl, {
+      timeout: 10000,
+    });
 
-    // Convert payload to ArrayBuffer
-    const payloadBuffer = new TextEncoder().encode(payload);
+    const JWKS = jose.createLocalJWKSet(jwksResponse.data);
 
-    // Create a new ArrayBuffer from the signature Uint8Array
+    // Decode the signature once (used for all attempts)
+    const signatureBytes = await decodeSignature(signature);
     const signatureBuffer = new Uint8Array(signatureBytes).buffer;
+    const payloadBuffer = new TextEncoder().encode(payload);
 
-    // Verify the signature
-    const isValid = await crypto.subtle.verify(
-      {
-        name: "ECDSA",
-        hash: "SHA-256",
-      },
-      publicKey,
-      signatureBuffer,
-      payloadBuffer
-    );
+    // Try each certificate until one succeeds
+    let lastError: string | undefined;
+    let successfulPublicKey: string | undefined;
+
+    for (const jwt of keyBindingCertificates) {
+      try {
+        // Verify JWT signature and extract payload
+        const { payload: jwtPayload } = await jose.jwtVerify(jwt, JWKS);
+
+        // Verify ename matches
+        if (jwtPayload.ename !== eName) {
+          lastError = `JWT ename mismatch: expected ${eName}, got ${jwtPayload.ename}`;
+          continue;
+        }
 
+        // Extract publicKey from JWT payload
+        const publicKeyMultibase = jwtPayload.publicKey as string;
+        if (!publicKeyMultibase) {
+          lastError = "JWT payload missing publicKey";
+          continue;
+        }
+
+        // Decode the public key
+        const publicKeyBytes = await decodeMultibasePublicKey(publicKeyMultibase);
+        const publicKeyBuffer = new Uint8Array(publicKeyBytes).buffer;
+
+        // Import the public key for Web Crypto API
+        let publicKey;
+        try {
+          publicKey = await crypto.subtle.importKey(
+            "spki",
+            publicKeyBuffer,
+            {
+              name: "ECDSA",
+              namedCurve: "P-256",
+            },
+            false,
+            ["verify"]
+          );
+        } catch (importError) {
+          lastError = `Failed to import public key: ${importError instanceof Error ? importError.message : String(importError)}`;
+          continue;
+        }
+
+        // Verify the signature with this public key
+        const isValid = await crypto.subtle.verify(
+          {
+            name: "ECDSA",
+            hash: "SHA-256",
+          },
+          publicKey,
+          signatureBuffer,
+          payloadBuffer
+        );
+
+        if (isValid) {
+          // Success! Return immediately
+          return {
+            valid: true,
+            publicKey: publicKeyMultibase,
+          };
+        }
+
+        // Signature verification failed with this key, try next
+        lastError = "Signature verification failed";
+      } catch (error) {
+        // JWT verification or other error, try next certificate
+        lastError = error instanceof Error ? error.message : String(error);
+        continue;
+      }
+    }
+
+    // All certificates failed
     return {
-      valid: isValid,
-      publicKey: publicKeyMultibase,
-      error: isValid ? undefined : "Signature verification failed",
+      valid: false,
+      error: lastError || "All key binding certificates failed verification",
     };
   } catch (error) {
     return {
diff --git a/platforms/blabsy/package.json b/platforms/blabsy/package.json
index 4c805c5a4..8782a9940 100644
--- a/platforms/blabsy/package.json
+++ b/platforms/blabsy/package.json
@@ -61,4 +61,4 @@
     "lint-staged": {
         "**/*": "prettier --write --ignore-unknown"
     }
-}
\ No newline at end of file
+}
diff --git a/platforms/registry/src/index.ts b/platforms/registry/src/index.ts
index 98b1a5b36..7290191a3 100644
--- a/platforms/registry/src/index.ts
+++ b/platforms/registry/src/index.ts
@@ -3,7 +3,7 @@ import cors from "@fastify/cors";
 import dotenv from "dotenv";
 import fastify from "fastify";
 import { AppDataSource } from "./config/database";
-import { generateEntropy, generatePlatformToken, getJWK } from "./jwt";
+import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate, getJWK } from "./jwt";
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 
@@ -129,6 +129,36 @@ server.post("/platforms/certification", async (request, reply) => {
     }
 });
 
+// Generate key binding certificate (JWT binding ename and publicKey)
+server.post(
+    "/key-binding-certificate",
+    {
+        preHandler: checkSharedSecret,
+    },
+    async (request, reply) => {
+        try {
+            const { ename, publicKey } = request.body as {
+                ename: string;
+                publicKey: string;
+            };
+
+            if (!ename || !publicKey) {
+                return reply.status(400).send({
+                    error: "ename and publicKey are required",
+                });
+            }
+
+            const token = await generateKeyBindingCertificate(ename, publicKey);
+            return { token };
+        } catch (error) {
+            server.log.error(error);
+            reply.status(500).send({
+                error: "Failed to generate key binding certificate",
+            });
+        }
+    },
+);
+
 server.get("/platforms", async (request, reply) => {
     const platforms = [
         process.env.PUBLIC_PICTIQUE_BASE_URL,
diff --git a/platforms/registry/src/jwt.ts b/platforms/registry/src/jwt.ts
index 35af8a930..97da69dc4 100644
--- a/platforms/registry/src/jwt.ts
+++ b/platforms/registry/src/jwt.ts
@@ -66,6 +66,20 @@ export async function generatePlatformToken(platform: string): Promise<string> {
   return token;
 }
 
+// Generate and sign a JWT binding ename and publicKey together
+export async function generateKeyBindingCertificate(
+  ename: string,
+  publicKey: string
+): Promise<string> {
+  await initializeKeys();
+  const token = await new SignJWT({ ename, publicKey })
+    .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+    .setIssuedAt()
+    .setExpirationTime("1h")
+    .sign(privateKey);
+  return token;
+}
+
 // Get the JWK for verification
 export async function getJWK(): Promise<any> {
   await initializeKeys();
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e7b941f04..4f392a122 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -250,6 +250,9 @@ importers:
       import:
         specifier: ^0.0.6
         version: 0.0.6
+      jose:
+        specifier: ^5.2.0
+        version: 5.10.0
       svelte-loading-spinners:
         specifier: ^0.3.6
         version: 0.3.6
@@ -480,6 +483,9 @@ importers:
       axios:
         specifier: ^1.6.7
         version: 1.13.2
+      jose:
+        specifier: ^5.2.0
+        version: 5.10.0
       multiformats:
         specifier: ^13.3.2
         version: 13.4.1