Threat Modeling and Security Analysis of Threshold-Based Service Account Token Signing for Kubernetes

Kubernetes service account token signing relies on a single private key, creating a critical single point of failure that existing mitigations—bound tokens, RBAC, and network policies—cannot address. Threshold-based signing, where t-of-n independent signers must collaborate to produce a valid token, has been proposed as a structural solution. However, the security implications of introducing threshold cryptography into the Kubernetes authentication pipeline have not been systematically analyzed. This paper presents a formal threat model and comparative security analysis of four authentication architectures: (1) default Kubernetes single-key signing, (2) the External JWT Signer interface (KEP-740, stable v1.36), (3) SPIFFE/SPIRE workload identity, and (4) the proposed threshold-based signing model. We apply the STRIDE threat classification framework, construct attack trees for three critical threat scenarios, perform trust boundary analysis, and map threats to the MITRE ATT&CK for Containers matrix. Our analysis indicates that threshold signing improves insider threat resistance, key compromise resilience, and blast radius containment, while introducing new attack surfaces in signer coordination, distributed key generation, and bootstrap dependencies. We identify the conditions under which threshold signing offers a net security improvement and characterize six categories of residual risk that future implementations must address.