The hardest part of a custodial wallet is not key management. It is deciding the moment a deposit becomes real.
Key handling is a solved problem: isolate the signer, keep it off the API path, limit who can trigger it. Tedious, but well understood.
The ambiguity lives on the credit side. A transaction in the mempool is not money. One confirmation on one chain does not mean what it means on another. A reorg can take a deposit back after you have already shown the user a bigger number. Product wants instant credit; the ledger wants finality. Those two pull in opposite directions, and the gap between them is where custodial systems quietly lose money.
What I do: keep pending and confirmed as separate ledger states, and let only confirmed balance be spendable. Every credit is idempotent on the chain identifiers of that specific output, so a node rescan or a replayed block cannot double-credit anyone. Confirmation depth is a policy value per asset, not a constant buried in code. And a deposit that reorgs out gets a compensating entry, never a deletion.
The chain is an input. Your ledger stays the source of truth.
Where do you draw the instant-credit line — a fixed confirmation depth, or tiered by amount?