Private keys remain in memory indefinitely - no secure cleanup

Problem

The EOA class stores private keys in memory for the wallet's lifetime. There's no mechanism to securely zero-out sensitive key material when the wallet is no longer needed.

Location

src/protocol/account.ts - EOA class

Security Concern

• Private keys could be extracted from memory dumps
• Keys persist even after wallet is "done" being used
• No way for users to explicitly clear sensitive data

Recommendation

1. Add a destroy() method that zeros out the private key buffer
2. Document that users should call destroy() when done with a wallet
3. Consider using Uint8Array and explicitly zeroing bytes

destroy(): void {
  // Zero out the private key
  if (this.privateKey instanceof Uint8Array) {
    this.privateKey.fill(0);
  }
  // Mark as destroyed to prevent further use
  this._destroyed = true;
}

Priority

Critical - Security best practice for key management

Start in src/protocol/account.ts at the EOA class and inspect how the private key is stored and used throughout the wallet lifecycle. Implement and document an explicit cleanup path so the key material is zeroed and the destroyed wallet cannot be used afterward; done means callers have a clear destroy() API and its behavior is covered by the surrounding account checks.