The controller's identity store signs a message and never hands its key out, as it signed declarations.
The node-engine applies only a composition signed by the controller or the operator, and when the controller cannot compose its own fix the operator composes, signs and writes one at the terminal (ADR 0539 clauses 3 and 10).
jschoubben