docs(mpc): correct BLS/Corona/PQ mislabels (truthful naming)

mpcd implements only CGGMP21 (secp256k1 ECDSA), FROST (ed25519/ristretto), and
LSS signing sessions — there is no bls12-381 threshold signing session. The KMS
validator "bls" slot is secp256k1/CGGMP21; the "corona" slot is ed25519/FROST.
Neither is bls12-381 aggregation nor post-quantum. A "post-quantum" claim over
classical ed25519 is materially misleading.

- deployments/customer-3of5/topology.yaml: the `bls` entry asserted
  curve=bls12-381, protocol=BLS-Threshold for "Lux consensus (validator
  signing)". Corrected to secp256k1/CGGMP21 (what is actually custodied) with a
  note that mpcd cannot threshold-sign bls12-381 and that Lux consensus BLS is a
  native per-validator key, never custodied here. (Customer manifest — highest
  priority.)
- pkg/api/handlers_kms.go: the ValidatorKeySet doc called the custodied key a
  "Corona PQ-threshold key" — it is ed25519/FROST, not PQ and not the Corona
  R-LWE lattice protocol. Corrected.
- README.md: added a "Validator key slots vs. engine protocols" note so the
  secp256k1/ed25519 custody slots are not read as the bls12-381/lattice engine
  protocols of the same name.

Labeling only — no crypto change. The live 2-of-3 mpcd ECDSA is sound.

Co-authored-by: Hanzo Dev <[email protected]>

README.md

@@ -33,6 +33,17 @@ schemes — and is consumed by the teleport bus
 in `~/work/lux/threshold/CLAUDE.md` under "thresholdd — unified
 JSON-RPC daemon".
 
+> **Validator key slots vs. engine protocols (truthful naming).** The KMS
+> validator-key API (`pkg/api/handlers_kms.go`; hanzo KMS) provisions two slots
+> per validator whose NAMES do not describe their cryptography: the **"bls"
+> slot is secp256k1 signed via CGGMP21 threshold ECDSA** — NOT bls12-381
+> aggregation — and the **"corona" slot is ed25519 signed via FROST** — NOT the
+> Corona R-LWE lattice protocol and NOT post-quantum. The bls12-381,
+> Pulsar/Corona lattice, and double-lattice schemes in the table above are
+> `thresholdd` engine capabilities, not the validator-custody path. Lux
+> consensus BLS is a native per-validator bls12-381 key (PoP + aggregation),
+> never threshold-custodied by this service.
+
 ### Threshold Model
 
 ```

deployments/customer-3of5/topology.yaml

@@ -93,13 +93,18 @@ topology:
         - { network: "KSM",          name: "Kusama" }
       notes: "Schnorrkel/Ristretto255 via generic FROST over ristretto255 group"
 
+    # CORRECTION: mpcd does NOT provide bls12-381 threshold aggregation. There
+    # is no BLS signing session (only CGGMP21/FROST/LSS), so this deployment
+    # cannot threshold-sign bls12-381. Lux consensus BLS is a NATIVE
+    # per-validator bls12-381 key (PoP + aggregation) held by the validator
+    # itself, never threshold-custodied by this service. Validator signing that
+    # IS custodied here is secp256k1/CGGMP21 threshold ECDSA (see `ecdsa`).
     bls:
-      curve: "bls12-381"
-      protocol: "BLS-Threshold"
+      curve: "secp256k1"
+      protocol: "CGGMP21"
       chains:
-        - { network: "LUX",          name: "Lux consensus (validator signing)" }
-        - { network: "ETH",          name: "Ethereum beacon chain" }
-      notes: "Aggregatable threshold signatures for consensus"
+        - { network: "LUX", name: "Lux validator ECDSA (bridge/custody signing — NOT consensus)" }
+      notes: "secp256k1 threshold ECDSA. NOT bls12-381 aggregation; consensus BLS is native, not custodied here."
 
     frost_taproot:
       curve: "secp256k1"

pkg/api/handlers_kms.go

@@ -15,11 +15,19 @@ import (
 )
 
 // ValidatorKeySet holds the MPC wallet reference for a validator's custodied
-// Corona PQ-threshold key. The validator's BLS consensus key is deliberately
-// NOT here: BLS is consensus-only and lives as the validator's own native
-// per-validator crypto/bls key (PoP + signature aggregation, the consensus
-// fast-path), never threshold-custodied by this service. Only the Corona
-// PQ-threshold key is custodied (dealerless DKG).
+// "Corona" slot key.
+//
+// NAMING (truthful): the "Corona" slot is ed25519 signed via FROST threshold.
+// It is NOT post-quantum and NOT the Corona R-LWE lattice protocol (that is a
+// separate primitive in luxfi/threshold's dispatcher) — "Corona" here is a
+// legacy slot label, not a PQ claim. Likewise the paired "BLS" slot is
+// secp256k1/CGGMP21 threshold ECDSA, not bls12-381 aggregation.
+//
+// The validator's real BLS consensus key is deliberately NOT here: it is a
+// native per-validator bls12-381 key (PoP + signature aggregation, the
+// consensus fast-path) held by the validator itself, never threshold-custodied
+// by this service. Only the ed25519/FROST "Corona" slot is custodied here
+// (dealerless DKG).
 type ValidatorKeySet struct {
 	ValidatorID     string    `json:"validatorId"`
 	CoronaWalletID  string    `json:"coronaWalletId"`