diff --git a/api/signer-api.yml b/api/signer-api.yml
index c876a3a2..69239e38 100644
--- a/api/signer-api.yml
+++ b/api/signer-api.yml
@@ -60,7 +60,7 @@ paths:
 
   /signer/v1/request_signature:
     post:
-      summary: Send a signature request
+      summary: Request a signature for a 32-byte blob of data (typically a hash), signed by the requested BLS or ECDSA key.
       tags:
         - Signer
       security:
@@ -81,15 +81,15 @@ paths:
                   type: string
                   enum: [consensus, proxy_bls, proxy_ecdsa]
                 pubkey:
-                  description: Public key of the validator for consensus signatures
+                  description: The 48-byte BLS public key, with optional `0x` prefix, of the proposer key that you want to request a signature from.
                   $ref: "#/components/schemas/BlsPubkey"
                 proxy:
-                  description: BLS proxy pubkey or ECDSA address for proxy signatures
+                  description: The 48-byte BLS public key (for `proxy_bls` mode) or the 20-byte Ethereum address (for `proxy_ecdsa` mode), with optional `0x` prefix, of the proxy key that you want to request a signature from.
                   oneOf:
                     - $ref: "#/components/schemas/BlsPubkey"
                     - $ref: "#/components/schemas/EcdsaAddress"
                 object_root:
-                  description: The root of the object to be signed
+                  description: The 32-byte data you want to sign, with optional `0x` prefix.
                   type: string
                   format: hex
                   pattern: "^0x[a-fA-F0-9]{64}$"
@@ -112,7 +112,7 @@ paths:
                   object_root: "0x3e9f4a78b5c21d64f0b8e3d9a7f5c02b4d1e67a3c8f29b5d6e4a3b1c8f72e6d9"
       responses:
         "200":
-          description: Success
+          description: A successful signature response. The returned signature is the Merkle root hash of the provided `object_root` field and the requesting module's Signing ID as specified in the Commit-Boost configuration. For details on this signature, see the [signature structure documentation](https://commit-boost.github.io/commit-boost-client/developing/prop-commit-signing.md#structure-of-a-signature).
           content:
             application/json:
               schema:
@@ -126,8 +126,45 @@ paths:
                   value: "0xa3ffa9241f78279f1af04644cb8c79c2d8f02bcf0e28e2f186f6dcccac0a869c2be441fda50f0dea895cfce2e53f0989a3ffa9241f78279f1af04644cb8c79c2d8f02bcf0e28e2f186f6dcccac0a869c2be441fda50f0dea895cfce2e53f0989"
                 ProxyEcdsa:
                   value: "0x985b495f49d1b96db3bba3f6c5dd1810950317c10d4c2042bd316f338cdbe74359072e209b85e56ac492092d7860063dd096ca31b4e164ef27e3f8d508e656801c"
+        "400":
+          description: |
+            This can occur in several scenarios:
+            
+            - You requested an operation while using the Dirk signer mode instead of locally-managed signer mode, but Dirk doesn't support that operation.
+            - Something went wrong while preparing your request; the error text will provide more information.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - code
+                  - message
+                properties:
+                  code:
+                    type: number
+                    example: 400
+                  message:
+                    type: string
+                    example: "Bad request: Invalid pubkey format"
+        "401":
+          description: The requesting module did not provide a JWT string in the request's authorization header, or the JWT string was not configured in the signer service's configuration file as belonging to the module.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - code
+                  - message
+                properties:
+                  code:
+                    type: number
+                    example: 401
+                  message:
+                    type: string
+                    example: "Unauthorized"
+        
         "404":
-          description: Unknown value (pubkey, etc.)
+          description: You either requested a route that doesn't exist, or you requested a signature from a key that does not exist.
           content:
             application/json:
               schema:
@@ -142,8 +179,24 @@ paths:
                   message:
                     type: string
                     example: "Unknown pubkey"
+        "429":
+          description: Your module attempted and failed JWT authentication too many times recently, and is currently timed out. It cannot make any more requests until the timeout ends.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - code
+                  - message
+                properties:
+                  code:
+                    type: number
+                    example: 429
+                  message:
+                    type: string
+                    example: "Too many requests"
         "500":
-          description: Internal error
+          description: Your request was valid, but something went wrong internally that prevented it from being fulfilled.
           content:
             application/json:
               schema:
@@ -158,6 +211,22 @@ paths:
                   message:
                     type: string
                     example: "Internal error"
+        "502":
+          description: The signer service is running in Dirk signer mode, but Dirk could not be reached.
+          content:
+            application/json:
+              schema:
+                type: object
+                required:
+                  - code
+                  - message
+                properties:
+                  code:
+                    type: number
+                    example: 502
+                  message:
+                    type: string
+                    example: "Bad gateway: Dirk signer service is unreachable"
 
   /signer/v1/generate_proxy_key:
     post:
diff --git a/bin/src/lib.rs b/bin/src/lib.rs
index 126847b6..122a35fc 100644
--- a/bin/src/lib.rs
+++ b/bin/src/lib.rs
@@ -10,6 +10,9 @@ pub mod prelude {
             load_pbs_custom_config, LogsSettings, StartCommitModuleConfig, PBS_MODULE_NAME,
         },
         pbs::{BuilderEvent, BuilderEventClient, OnBuilderApiEvent},
+        signature::{
+            verify_proposer_commitment_signature_bls, verify_proposer_commitment_signature_ecdsa,
+        },
         signer::{BlsPublicKey, BlsSignature, EcdsaSignature},
         types::Chain,
         utils::{initialize_tracing_log, utcnow_ms, utcnow_ns, utcnow_sec, utcnow_us},
diff --git a/config.example.toml b/config.example.toml
index 8ed5b139..f4612081 100644
--- a/config.example.toml
+++ b/config.example.toml
@@ -152,10 +152,10 @@ url = "http://0xa119589bb33ef52acbb8116832bec2b58fca590fe5c85eac5d3230b44d5bc09f
 #   - Dirk: a remote Dirk instance
 #   - Local: a local Signer module
 # More details on the docs (https://commit-boost.github.io/commit-boost-client/get_started/configuration/#signer-module)
-# [signer]
+[signer]
 # Docker image to use for the Signer module.
 # OPTIONAL, DEFAULT: ghcr.io/commit-boost/signer:latest
-# docker_image = "ghcr.io/commit-boost/signer:latest"
+docker_image = "ghcr.io/commit-boost/signer:latest"
 # Host to bind the Signer API server to
 # OPTIONAL, DEFAULT: 127.0.0.1
 host = "127.0.0.1"
@@ -249,6 +249,8 @@ proxy_dir = "./proxies"
 [[modules]]
 # Unique ID of the module
 id = "DA_COMMIT"
+# Unique hash that the Signer service will combine with the incoming data in signing requests to generate a signature specific to this module
+signing_id = "0x6a33a23ef26a4836979edff86c493a69b26ccf0b4a16491a815a13787657431b"
 # Type of the module. Supported values: commit, events
 type = "commit"
 # Docker image of the module
diff --git a/crates/common/src/commit/request.rs b/crates/common/src/commit/request.rs
index 9a67dcc2..5bc3a14b 100644
--- a/crates/common/src/commit/request.rs
+++ b/crates/common/src/commit/request.rs
@@ -6,7 +6,7 @@ use std::{
 
 use alloy::{
     hex,
-    primitives::{Address, B256},
+    primitives::{aliases::B32, Address, B256},
     rpc::types::beacon::BlsSignature,
 };
 use derive_more::derive::From;
@@ -62,7 +62,8 @@ impl<T: ProxyId> SignedProxyDelegation<T> {
             &self.message.delegator,
             &self.message,
             &self.signature,
-            COMMIT_BOOST_DOMAIN,
+            None,
+            &B32::from(COMMIT_BOOST_DOMAIN),
         )
     }
 }
diff --git a/crates/common/src/config/module.rs b/crates/common/src/config/module.rs
index 16b089ca..71c4891b 100644
--- a/crates/common/src/config/module.rs
+++ b/crates/common/src/config/module.rs
@@ -1,5 +1,6 @@
 use std::collections::HashMap;
 
+use alloy::primitives::B256;
 use eyre::{ContextCompat, Result};
 use serde::{de::DeserializeOwned, Deserialize, Serialize};
 use toml::Table;
@@ -37,6 +38,8 @@ pub struct StaticModuleConfig {
     /// Type of the module
     #[serde(rename = "type")]
     pub kind: ModuleKind,
+    /// Signing ID for the module to use when requesting signatures
+    pub signing_id: B256,
 }
 
 /// Runtime config to start a module
diff --git a/crates/common/src/config/signer.rs b/crates/common/src/config/signer.rs
index 9e5f2b46..a397d696 100644
--- a/crates/common/src/config/signer.rs
+++ b/crates/common/src/config/signer.rs
@@ -4,25 +4,59 @@ use std::{
     path::PathBuf,
 };
 
+use alloy::primitives::B256;
 use docker_image::DockerImage;
-use eyre::{bail, ensure, OptionExt, Result};
+use eyre::{bail, ensure, Context, OptionExt, Result};
 use serde::{Deserialize, Serialize};
 use tonic::transport::{Certificate, Identity};
 use url::Url;
 
 use super::{
-    load_jwt_secrets, load_optional_env_var, utils::load_env_var, CommitBoostConfig,
-    SIGNER_ENDPOINT_ENV, SIGNER_IMAGE_DEFAULT, SIGNER_JWT_AUTH_FAIL_LIMIT_DEFAULT,
-    SIGNER_JWT_AUTH_FAIL_LIMIT_ENV, SIGNER_JWT_AUTH_FAIL_TIMEOUT_SECONDS_DEFAULT,
-    SIGNER_JWT_AUTH_FAIL_TIMEOUT_SECONDS_ENV, SIGNER_PORT_DEFAULT,
+    load_optional_env_var, utils::load_env_var, CommitBoostConfig, SIGNER_ENDPOINT_ENV,
+    SIGNER_IMAGE_DEFAULT, SIGNER_JWT_AUTH_FAIL_LIMIT_DEFAULT, SIGNER_JWT_AUTH_FAIL_LIMIT_ENV,
+    SIGNER_JWT_AUTH_FAIL_TIMEOUT_SECONDS_DEFAULT, SIGNER_JWT_AUTH_FAIL_TIMEOUT_SECONDS_ENV,
+    SIGNER_PORT_DEFAULT,
 };
 use crate::{
-    config::{DIRK_CA_CERT_ENV, DIRK_CERT_ENV, DIRK_DIR_SECRETS_ENV, DIRK_KEY_ENV},
+    config::{
+        load_jwt_secrets, DIRK_CA_CERT_ENV, DIRK_CERT_ENV, DIRK_DIR_SECRETS_ENV, DIRK_KEY_ENV,
+    },
     signer::{ProxyStore, SignerLoader},
     types::{Chain, ModuleId},
     utils::{default_host, default_u16, default_u32},
 };
 
+/// The signing configuration for a commitment module.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ModuleSigningConfig {
+    /// Human-readable name of the module.
+    pub module_name: ModuleId,
+
+    /// The JWT secret for the module to communicate with the signer module.
+    pub jwt_secret: String,
+
+    /// A unique identifier for the module, which is used when signing requests
+    /// to generate signatures for this module. Must be a 32-byte hex string.
+    /// A leading 0x prefix is optional.
+    pub signing_id: B256,
+}
+
+impl ModuleSigningConfig {
+    pub fn validate(&self) -> Result<()> {
+        // Ensure the JWT secret is not empty
+        if self.jwt_secret.is_empty() {
+            bail!("JWT secret cannot be empty");
+        }
+
+        // Ensure the signing ID is a valid B256
+        if self.signing_id.is_zero() {
+            bail!("Signing ID cannot be zero");
+        }
+
+        Ok(())
+    }
+}
+
 #[derive(Debug, Serialize, Deserialize, Clone)]
 #[serde(rename_all = "snake_case")]
 pub struct SignerConfig {
@@ -130,7 +164,7 @@ pub struct StartSignerConfig {
     pub loader: Option<SignerLoader>,
     pub store: Option<ProxyStore>,
     pub endpoint: SocketAddr,
-    pub jwts: HashMap<ModuleId, String>,
+    pub mod_signing_configs: HashMap<ModuleId, ModuleSigningConfig>,
     pub admin_secret: String,
     pub jwt_auth_fail_limit: u32,
     pub jwt_auth_fail_timeout_seconds: u32,
@@ -141,7 +175,11 @@ impl StartSignerConfig {
     pub fn load_from_env() -> Result<Self> {
         let config = CommitBoostConfig::from_env_path()?;
 
-        let (admin_secret, jwts) = load_jwt_secrets()?;
+        let (admin_secret, jwt_secrets) = load_jwt_secrets()?;
+
+        // Load the module signing configs
+        let mod_signing_configs = load_module_signing_configs(&config, &jwt_secrets)
+            .wrap_err("Failed to load module signing configs")?;
 
         let signer_config = config.signer.ok_or_eyre("Signer config is missing")?;
 
@@ -175,7 +213,7 @@ impl StartSignerConfig {
                 chain: config.chain,
                 loader: Some(loader),
                 endpoint,
-                jwts,
+                mod_signing_configs,
                 admin_secret,
                 jwt_auth_fail_limit,
                 jwt_auth_fail_timeout_seconds,
@@ -206,7 +244,7 @@ impl StartSignerConfig {
                 Ok(StartSignerConfig {
                     chain: config.chain,
                     endpoint,
-                    jwts,
+                    mod_signing_configs,
                     admin_secret,
                     jwt_auth_fail_limit,
                     jwt_auth_fail_timeout_seconds,
@@ -235,3 +273,341 @@ impl StartSignerConfig {
         }
     }
 }
+
+/// Loads the signing configurations for each module defined in the Commit Boost
+/// config, coupling them with their JWT secrets and handling any potential
+/// duplicates or missing values.
+pub fn load_module_signing_configs(
+    config: &CommitBoostConfig,
+    jwt_secrets: &HashMap<ModuleId, String>,
+) -> Result<HashMap<ModuleId, ModuleSigningConfig>> {
+    let mut mod_signing_configs = HashMap::new();
+    let modules = config.modules.as_ref().ok_or_eyre("No modules defined in the config")?;
+
+    let mut seen_jwt_secrets = HashMap::new();
+    let mut seen_signing_ids = HashMap::new();
+    for module in modules {
+        // Validate the module ID
+        ensure!(!module.id.is_empty(), "Module ID cannot be empty");
+
+        // Make sure it hasn't been used yet
+        ensure!(
+            !mod_signing_configs.contains_key(&module.id),
+            "Duplicate module config detected: ID {} is already used",
+            module.id
+        );
+
+        // Make sure the JWT secret is present
+        let jwt_secret = match jwt_secrets.get(&module.id) {
+            Some(secret) => secret.clone(),
+            None => bail!("JWT secret for module {} is missing", module.id),
+        };
+        // Create the module signing config and validate it
+        let module_signing_config = ModuleSigningConfig {
+            module_name: module.id.clone(),
+            jwt_secret,
+            signing_id: module.signing_id,
+        };
+        module_signing_config
+            .validate()
+            .wrap_err(format!("Invalid signing config for module {}", module.id))?;
+
+        // Check for duplicates in JWT secrets and signing IDs
+        if let Some(existing_module) =
+            seen_jwt_secrets.insert(module_signing_config.jwt_secret.clone(), &module.id)
+        {
+            bail!("Duplicate JWT secret detected for modules {} and {}", existing_module, module.id)
+        };
+        if let Some(existing_module) =
+            seen_signing_ids.insert(module_signing_config.signing_id, &module.id)
+        {
+            bail!("Duplicate signing ID detected for modules {} and {}", existing_module, module.id)
+        };
+
+        mod_signing_configs.insert(module.id.clone(), module_signing_config);
+    }
+
+    Ok(mod_signing_configs)
+}
+
+#[cfg(test)]
+mod tests {
+    use alloy::primitives::{b256, Uint};
+
+    use super::*;
+    use crate::config::{LogsSettings, ModuleKind, PbsConfig, StaticModuleConfig, StaticPbsConfig};
+
+    async fn get_base_config() -> CommitBoostConfig {
+        CommitBoostConfig {
+            chain: Chain::Hoodi,
+            relays: vec![],
+            pbs: StaticPbsConfig {
+                docker_image: String::from(""),
+                pbs_config: PbsConfig {
+                    host: Ipv4Addr::new(127, 0, 0, 1),
+                    port: 0,
+                    relay_check: false,
+                    wait_all_registrations: false,
+                    timeout_get_header_ms: 0,
+                    timeout_get_payload_ms: 0,
+                    timeout_register_validator_ms: 0,
+                    skip_sigverify: false,
+                    min_bid_wei: Uint::<256, 4>::from(0),
+                    late_in_slot_time_ms: 0,
+                    extra_validation_enabled: false,
+                    rpc_url: None,
+                    http_timeout_seconds: 30,
+                    register_validator_retry_limit: 3,
+                },
+                with_signer: true,
+            },
+            muxes: None,
+            modules: Some(vec![]),
+            signer: None,
+            metrics: None,
+            logs: LogsSettings::default(),
+        }
+    }
+
+    async fn create_module_config(id: ModuleId, signing_id: B256) -> StaticModuleConfig {
+        StaticModuleConfig {
+            id: id.clone(),
+            signing_id,
+            docker_image: String::from(""),
+            env: None,
+            env_file: None,
+            kind: ModuleKind::Commit,
+        }
+    }
+
+    #[tokio::test]
+    async fn test_good_config() -> Result<()> {
+        let mut cfg = get_base_config().await;
+        let first_module_id = ModuleId("test_module".to_string());
+        let first_signing_id =
+            b256!("0101010101010101010101010101010101010101010101010101010101010101");
+        let second_module_id = ModuleId("2nd_test_module".to_string());
+        let second_signing_id =
+            b256!("0202020202020202020202020202020202020202020202020202020202020202");
+
+        cfg.modules = Some(vec![
+            create_module_config(first_module_id.clone(), first_signing_id).await,
+            create_module_config(second_module_id.clone(), second_signing_id).await,
+        ]);
+
+        let jwts = HashMap::from([
+            (first_module_id.clone(), "supersecret".to_string()),
+            (second_module_id.clone(), "another-secret".to_string()),
+        ]);
+
+        // Load the mod signing configuration
+        let mod_signing_configs = load_module_signing_configs(&cfg, &jwts)
+            .wrap_err("Failed to load module signing configs")?;
+        assert!(mod_signing_configs.len() == 2, "Expected 2 mod signing configurations");
+
+        // Check the first module
+        let module_1 = mod_signing_configs
+            .get(&first_module_id)
+            .unwrap_or_else(|| panic!("Missing '{first_module_id}' in mod signing configs"));
+        assert_eq!(module_1.module_name, first_module_id, "Module name mismatch for 'test_module'");
+        assert_eq!(
+            module_1.jwt_secret, jwts[&first_module_id],
+            "JWT secret mismatch for '{first_module_id}'"
+        );
+        assert_eq!(
+            module_1.signing_id, first_signing_id,
+            "Signing ID mismatch for '{first_module_id}'"
+        );
+
+        // Check the second module
+        let module_2 = mod_signing_configs
+            .get(&second_module_id)
+            .unwrap_or_else(|| panic!("Missing '{second_module_id}' in mod signing configs"));
+        assert_eq!(
+            module_2.module_name, second_module_id,
+            "Module name mismatch for '{second_module_id}'"
+        );
+        assert_eq!(
+            module_2.jwt_secret, jwts[&second_module_id],
+            "JWT secret mismatch for '{second_module_id}'"
+        );
+        assert_eq!(
+            module_2.signing_id, second_signing_id,
+            "Signing ID mismatch for '{second_module_id}'"
+        );
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_duplicate_module_names() -> Result<()> {
+        let mut cfg = get_base_config().await;
+        let first_module_id = ModuleId("test_module".to_string());
+        let first_signing_id =
+            b256!("0101010101010101010101010101010101010101010101010101010101010101");
+        let second_module_id = ModuleId("2nd_test_module".to_string());
+        let second_signing_id =
+            b256!("0202020202020202020202020202020202020202020202020202020202020202");
+
+        cfg.modules = Some(vec![
+            create_module_config(first_module_id.clone(), first_signing_id).await,
+            create_module_config(first_module_id.clone(), second_signing_id).await, /* Duplicate
+                                                                                     * module
+                                                                                     * name */
+        ]);
+
+        let jwts = HashMap::from([
+            (first_module_id.clone(), "supersecret".to_string()),
+            (second_module_id.clone(), "another-secret".to_string()),
+        ]);
+
+        // Make sure there was an error
+        let result = load_module_signing_configs(&cfg, &jwts);
+        assert!(result.is_err(), "Expected error due to duplicate module names");
+        if let Err(e) = result {
+            assert_eq!(
+                e.to_string(),
+                format!("Duplicate module config detected: ID {first_module_id} is already used")
+            );
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_duplicate_jwt_secrets() -> Result<()> {
+        let mut cfg = get_base_config().await;
+        let first_module_id = ModuleId("test_module".to_string());
+        let first_signing_id =
+            b256!("0101010101010101010101010101010101010101010101010101010101010101");
+        let second_module_id = ModuleId("2nd_test_module".to_string());
+        let second_signing_id =
+            b256!("0202020202020202020202020202020202020202020202020202020202020202");
+
+        cfg.modules = Some(vec![
+            create_module_config(first_module_id.clone(), first_signing_id).await,
+            create_module_config(second_module_id.clone(), second_signing_id).await,
+        ]);
+
+        let jwts = HashMap::from([
+            (first_module_id.clone(), "supersecret".to_string()),
+            (second_module_id.clone(), "supersecret".to_string()), /* Duplicate JWT secret */
+        ]);
+
+        // Make sure there was an error
+        let result = load_module_signing_configs(&cfg, &jwts);
+        assert!(result.is_err(), "Expected error due to duplicate JWT secrets");
+        if let Err(e) = result {
+            assert_eq!(
+                e.to_string(),
+                format!(
+                    "Duplicate JWT secret detected for modules {first_module_id} and {second_module_id}",
+                )
+            );
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_duplicate_signing_ids() -> Result<()> {
+        let mut cfg = get_base_config().await;
+        let first_module_id = ModuleId("test_module".to_string());
+        let first_signing_id =
+            b256!("0101010101010101010101010101010101010101010101010101010101010101");
+        let second_module_id = ModuleId("2nd_test_module".to_string());
+
+        cfg.modules = Some(vec![
+            create_module_config(first_module_id.clone(), first_signing_id).await,
+            create_module_config(second_module_id.clone(), first_signing_id).await, /* Duplicate signing ID */
+        ]);
+
+        let jwts = HashMap::from([
+            (first_module_id.clone(), "supersecret".to_string()),
+            (second_module_id.clone(), "another-secret".to_string()),
+        ]);
+
+        // Make sure there was an error
+        let result = load_module_signing_configs(&cfg, &jwts);
+        assert!(result.is_err(), "Expected error due to duplicate signing IDs");
+        if let Err(e) = result {
+            assert_eq!(
+                e.to_string(),
+                format!(
+                    "Duplicate signing ID detected for modules {first_module_id} and {second_module_id}",
+                )
+            );
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_missing_jwt_secret() -> Result<()> {
+        let mut cfg = get_base_config().await;
+        let first_module_id = ModuleId("test_module".to_string());
+        let first_signing_id =
+            b256!("0101010101010101010101010101010101010101010101010101010101010101");
+        let second_module_id = ModuleId("2nd_test_module".to_string());
+        let second_signing_id =
+            b256!("0202020202020202020202020202020202020202020202020202020202020202");
+
+        cfg.modules = Some(vec![
+            create_module_config(first_module_id.clone(), first_signing_id).await,
+            create_module_config(second_module_id.clone(), second_signing_id).await,
+        ]);
+
+        let jwts = HashMap::from([(second_module_id.clone(), "another-secret".to_string())]);
+
+        // Make sure there was an error
+        let result = load_module_signing_configs(&cfg, &jwts);
+        assert!(result.is_err(), "Expected error due to missing JWT secret");
+        if let Err(e) = result {
+            assert_eq!(
+                e.to_string(),
+                format!("JWT secret for module {first_module_id} is missing")
+            );
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_empty_jwt_secret() -> Result<()> {
+        let mut cfg = get_base_config().await;
+        let first_module_id = ModuleId("test_module".to_string());
+        let first_signing_id =
+            b256!("0101010101010101010101010101010101010101010101010101010101010101");
+
+        cfg.modules =
+            Some(vec![create_module_config(first_module_id.clone(), first_signing_id).await]);
+
+        let jwts = HashMap::from([(first_module_id.clone(), "".to_string())]);
+
+        // Make sure there was an error
+        let result = load_module_signing_configs(&cfg, &jwts);
+        assert!(result.is_err(), "Expected error due to empty JWT secret");
+        if let Err(e) = result {
+            assert!(format!("{:?}", e).contains("JWT secret cannot be empty"));
+        }
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_zero_signing_id() -> Result<()> {
+        let mut cfg = get_base_config().await;
+        let first_module_id = ModuleId("test_module".to_string());
+        let first_signing_id =
+            b256!("0000000000000000000000000000000000000000000000000000000000000000");
+
+        cfg.modules =
+            Some(vec![create_module_config(first_module_id.clone(), first_signing_id).await]);
+
+        let jwts = HashMap::from([(first_module_id.clone(), "supersecret".to_string())]);
+
+        // Make sure there was an error
+        let result = load_module_signing_configs(&cfg, &jwts);
+        assert!(result.is_err(), "Expected error due to zero signing ID");
+        if let Err(e) = result {
+            assert!(format!("{:?}", e).contains("Signing ID cannot be zero"));
+        }
+        Ok(())
+    }
+}
diff --git a/crates/common/src/config/utils.rs b/crates/common/src/config/utils.rs
index 7ab346f1..5e8e3a65 100644
--- a/crates/common/src/config/utils.rs
+++ b/crates/common/src/config/utils.rs
@@ -4,8 +4,11 @@ use alloy::rpc::types::beacon::BlsPublicKey;
 use eyre::{bail, Context, Result};
 use serde::de::DeserializeOwned;
 
-use super::{ADMIN_JWT_ENV, JWTS_ENV};
-use crate::{config::MUXER_HTTP_MAX_LENGTH, types::ModuleId, utils::read_chunked_body_with_max};
+use crate::{
+    config::{ADMIN_JWT_ENV, JWTS_ENV, MUXER_HTTP_MAX_LENGTH},
+    types::ModuleId,
+    utils::read_chunked_body_with_max,
+};
 
 pub fn load_env_var(env: &str) -> Result<String> {
     std::env::var(env).wrap_err(format!("{env} is not set"))
@@ -90,6 +93,7 @@ pub fn decode_string_to_map(raw: &str) -> Result<HashMap<ModuleId, String>> {
 mod tests {
     use super::*;
 
+    /// TODO: This was only used by the old JWT loader, can it be removed now?
     #[test]
     fn test_decode_string_to_map() {
         let raw = " KEY=VALUE , KEY2=value2 ";
diff --git a/crates/common/src/pbs/types/get_header.rs b/crates/common/src/pbs/types/get_header.rs
index 18d5361f..c5e40a21 100644
--- a/crates/common/src/pbs/types/get_header.rs
+++ b/crates/common/src/pbs/types/get_header.rs
@@ -94,7 +94,7 @@ pub struct ExecutionPayloadHeaderMessageElectra {
 
 #[cfg(test)]
 mod tests {
-    use alloy::primitives::U256;
+    use alloy::primitives::{aliases::B32, U256};
 
     use super::*;
     use crate::{
@@ -176,7 +176,8 @@ mod tests {
             &parsed.message.pubkey,
             &parsed.message,
             &parsed.signature,
-            APPLICATION_BUILDER_DOMAIN
+            None,
+            &B32::from(APPLICATION_BUILDER_DOMAIN)
         )
         .is_ok())
     }
diff --git a/crates/common/src/signature.rs b/crates/common/src/signature.rs
index e51e2291..cd960031 100644
--- a/crates/common/src/signature.rs
+++ b/crates/common/src/signature.rs
@@ -1,12 +1,15 @@
-use alloy::rpc::types::beacon::{constants::BLS_DST_SIG, BlsPublicKey, BlsSignature};
+use alloy::{
+    primitives::{aliases::B32, Address, B256},
+    rpc::types::beacon::{constants::BLS_DST_SIG, BlsPublicKey, BlsSignature},
+};
 use tree_hash::TreeHash;
 use tree_hash_derive::TreeHash;
 
 use crate::{
     constants::{COMMIT_BOOST_DOMAIN, GENESIS_VALIDATORS_ROOT},
     error::BlstErrorWrapper,
-    signer::{verify_bls_signature, BlsSecretKey},
-    types::Chain,
+    signer::{verify_bls_signature, verify_ecdsa_signature, BlsSecretKey, EcdsaSignature},
+    types::{self, Chain},
 };
 
 pub fn sign_message(secret_key: &BlsSecretKey, msg: &[u8]) -> BlsSignature {
@@ -14,21 +17,29 @@ pub fn sign_message(secret_key: &BlsSecretKey, msg: &[u8]) -> BlsSignature {
     BlsSignature::from_slice(&signature)
 }
 
-pub fn compute_signing_root(object_root: [u8; 32], signing_domain: [u8; 32]) -> [u8; 32] {
-    #[derive(Default, Debug, TreeHash)]
-    struct SigningData {
-        object_root: [u8; 32],
-        signing_domain: [u8; 32],
+pub fn compute_prop_commit_signing_root(
+    chain: Chain,
+    object_root: &B256,
+    module_signing_id: Option<&B256>,
+    domain_mask: &B32,
+) -> B256 {
+    let domain = compute_domain(chain, domain_mask);
+    match module_signing_id {
+        Some(id) => {
+            let object_root =
+                types::PropCommitSigningInfo { data: *object_root, module_signing_id: *id }
+                    .tree_hash_root();
+            types::SigningData { object_root, signing_domain: domain }.tree_hash_root()
+        }
+        None => types::SigningData { object_root: *object_root, signing_domain: domain }
+            .tree_hash_root(),
     }
-
-    let signing_data = SigningData { object_root, signing_domain };
-    signing_data.tree_hash_root().0
 }
 
 // NOTE: this currently works only for builder domain signatures and
 // verifications
 // ref: https://github.com/ralexstokes/ethereum-consensus/blob/cf3c404043230559660810bc0c9d6d5a8498d819/ethereum-consensus/src/builder/mod.rs#L26-L29
-pub fn compute_domain(chain: Chain, domain_mask: [u8; 4]) -> [u8; 32] {
+pub fn compute_domain(chain: Chain, domain_mask: &B32) -> B256 {
     #[derive(Debug, TreeHash)]
     struct ForkData {
         fork_version: [u8; 4],
@@ -36,7 +47,7 @@ pub fn compute_domain(chain: Chain, domain_mask: [u8; 4]) -> [u8; 32] {
     }
 
     let mut domain = [0u8; 32];
-    domain[..4].copy_from_slice(&domain_mask);
+    domain[..4].copy_from_slice(&domain_mask.0);
 
     let fork_version = chain.genesis_fork_version();
     let fd = ForkData { fork_version, genesis_validators_root: GENESIS_VALIDATORS_ROOT };
@@ -44,7 +55,7 @@ pub fn compute_domain(chain: Chain, domain_mask: [u8; 4]) -> [u8; 32] {
 
     domain[4..].copy_from_slice(&fork_data_root[..28]);
 
-    domain
+    B256::from(domain)
 }
 
 pub fn verify_signed_message<T: TreeHash>(
@@ -52,69 +63,114 @@ pub fn verify_signed_message<T: TreeHash>(
     pubkey: &BlsPublicKey,
     msg: &T,
     signature: &BlsSignature,
-    domain_mask: [u8; 4],
+    module_signing_id: Option<&B256>,
+    domain_mask: &B32,
 ) -> Result<(), BlstErrorWrapper> {
-    let domain = compute_domain(chain, domain_mask);
-    let signing_root = compute_signing_root(msg.tree_hash_root().0, domain);
-
-    verify_bls_signature(pubkey, &signing_root, signature)
+    let signing_root = compute_prop_commit_signing_root(
+        chain,
+        &msg.tree_hash_root(),
+        module_signing_id,
+        domain_mask,
+    );
+    verify_bls_signature(pubkey, signing_root.as_slice(), signature)
 }
 
+/// Signs a message with the Beacon builder domain.
 pub fn sign_builder_message(
     chain: Chain,
     secret_key: &BlsSecretKey,
     msg: &impl TreeHash,
 ) -> BlsSignature {
-    sign_builder_root(chain, secret_key, msg.tree_hash_root().0)
+    sign_builder_root(chain, secret_key, &msg.tree_hash_root())
 }
 
 pub fn sign_builder_root(
     chain: Chain,
     secret_key: &BlsSecretKey,
-    object_root: [u8; 32],
+    object_root: &B256,
 ) -> BlsSignature {
-    let domain = chain.builder_domain();
-    let signing_root = compute_signing_root(object_root, domain);
-    sign_message(secret_key, &signing_root)
+    let signing_domain = chain.builder_domain();
+    let signing_data =
+        types::SigningData { object_root: object_root.tree_hash_root(), signing_domain };
+    let signing_root = signing_data.tree_hash_root();
+    sign_message(secret_key, signing_root.as_slice())
 }
 
 pub fn sign_commit_boost_root(
     chain: Chain,
     secret_key: &BlsSecretKey,
-    object_root: [u8; 32],
+    object_root: &B256,
+    module_signing_id: Option<&B256>,
 ) -> BlsSignature {
-    let domain = compute_domain(chain, COMMIT_BOOST_DOMAIN);
-    let signing_root = compute_signing_root(object_root, domain);
-    sign_message(secret_key, &signing_root)
+    let signing_root = compute_prop_commit_signing_root(
+        chain,
+        object_root,
+        module_signing_id,
+        &B32::from(COMMIT_BOOST_DOMAIN),
+    );
+    sign_message(secret_key, signing_root.as_slice())
 }
 
+// ==============================
+// === Signature Verification ===
+// ==============================
+
+/// Verifies that a proposer commitment signature was generated by the given BLS
+/// key for the provided message, chain ID, and module signing ID.
+pub fn verify_proposer_commitment_signature_bls(
+    chain: Chain,
+    pubkey: &BlsPublicKey,
+    msg: &impl TreeHash,
+    signature: &BlsSignature,
+    module_signing_id: &B256,
+) -> Result<(), BlstErrorWrapper> {
+    let signing_domain = compute_domain(chain, &B32::from(COMMIT_BOOST_DOMAIN));
+    let object_root = types::PropCommitSigningInfo {
+        data: msg.tree_hash_root(),
+        module_signing_id: *module_signing_id,
+    }
+    .tree_hash_root();
+    let signing_root = types::SigningData { object_root, signing_domain }.tree_hash_root();
+    verify_bls_signature(pubkey, signing_root.as_slice(), signature)
+}
+
+/// Verifies that a proposer commitment signature was generated by the given
+/// ECDSA key for the provided message, chain ID, and module signing ID.
+pub fn verify_proposer_commitment_signature_ecdsa(
+    chain: Chain,
+    address: &Address,
+    msg: &impl TreeHash,
+    signature: &EcdsaSignature,
+    module_signing_id: &B256,
+) -> Result<(), eyre::Report> {
+    let object_root = msg.tree_hash_root();
+    let signing_domain = compute_domain(chain, &B32::from(COMMIT_BOOST_DOMAIN));
+    let object_root =
+        types::PropCommitSigningInfo { data: object_root, module_signing_id: *module_signing_id }
+            .tree_hash_root();
+    let signing_root = types::SigningData { object_root, signing_domain }.tree_hash_root();
+    verify_ecdsa_signature(address, &signing_root, signature)
+}
+
+// ===============
+// === Testing ===
+// ===============
+
 #[cfg(test)]
 mod tests {
 
+    use alloy::primitives::aliases::B32;
+
     use super::compute_domain;
     use crate::{constants::APPLICATION_BUILDER_DOMAIN, types::Chain};
 
     #[test]
     fn test_builder_domains() {
-        assert_eq!(
-            compute_domain(Chain::Mainnet, APPLICATION_BUILDER_DOMAIN),
-            Chain::Mainnet.builder_domain()
-        );
-        assert_eq!(
-            compute_domain(Chain::Holesky, APPLICATION_BUILDER_DOMAIN),
-            Chain::Holesky.builder_domain()
-        );
-        assert_eq!(
-            compute_domain(Chain::Sepolia, APPLICATION_BUILDER_DOMAIN),
-            Chain::Sepolia.builder_domain()
-        );
-        assert_eq!(
-            compute_domain(Chain::Helder, APPLICATION_BUILDER_DOMAIN),
-            Chain::Helder.builder_domain()
-        );
-        assert_eq!(
-            compute_domain(Chain::Hoodi, APPLICATION_BUILDER_DOMAIN),
-            Chain::Hoodi.builder_domain()
-        );
+        let domain = &B32::from(APPLICATION_BUILDER_DOMAIN);
+        assert_eq!(compute_domain(Chain::Mainnet, domain), Chain::Mainnet.builder_domain());
+        assert_eq!(compute_domain(Chain::Holesky, domain), Chain::Holesky.builder_domain());
+        assert_eq!(compute_domain(Chain::Sepolia, domain), Chain::Sepolia.builder_domain());
+        assert_eq!(compute_domain(Chain::Helder, domain), Chain::Helder.builder_domain());
+        assert_eq!(compute_domain(Chain::Hoodi, domain), Chain::Hoodi.builder_domain());
     }
 }
diff --git a/crates/common/src/signer/schemes/bls.rs b/crates/common/src/signer/schemes/bls.rs
index f133b2bc..15367f36 100644
--- a/crates/common/src/signer/schemes/bls.rs
+++ b/crates/common/src/signer/schemes/bls.rs
@@ -1,5 +1,5 @@
-use alloy::rpc::types::beacon::constants::BLS_DST_SIG;
 pub use alloy::rpc::types::beacon::BlsSignature;
+use alloy::{primitives::B256, rpc::types::beacon::constants::BLS_DST_SIG};
 use blst::BLST_ERROR;
 use tree_hash::TreeHash;
 
@@ -32,20 +32,32 @@ impl BlsSigner {
         }
     }
 
-    pub fn secret(&self) -> [u8; 32] {
+    pub fn secret(&self) -> B256 {
         match self {
-            BlsSigner::Local(secret) => secret.clone().to_bytes(),
+            BlsSigner::Local(secret) => B256::from(secret.clone().to_bytes()),
         }
     }
 
-    pub async fn sign(&self, chain: Chain, object_root: [u8; 32]) -> BlsSignature {
+    pub async fn sign(
+        &self,
+        chain: Chain,
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
+    ) -> BlsSignature {
         match self {
-            BlsSigner::Local(sk) => sign_commit_boost_root(chain, sk, object_root),
+            BlsSigner::Local(sk) => {
+                sign_commit_boost_root(chain, sk, object_root, module_signing_id)
+            }
         }
     }
 
-    pub async fn sign_msg(&self, chain: Chain, msg: &impl TreeHash) -> BlsSignature {
-        self.sign(chain, msg.tree_hash_root().0).await
+    pub async fn sign_msg(
+        &self,
+        chain: Chain,
+        msg: &impl TreeHash,
+        module_signing_id: Option<&B256>,
+    ) -> BlsSignature {
+        self.sign(chain, &msg.tree_hash_root(), module_signing_id).await
     }
 }
 
diff --git a/crates/common/src/signer/schemes/ecdsa.rs b/crates/common/src/signer/schemes/ecdsa.rs
index 612df5e3..907340f1 100644
--- a/crates/common/src/signer/schemes/ecdsa.rs
+++ b/crates/common/src/signer/schemes/ecdsa.rs
@@ -1,7 +1,7 @@
 use std::{ops::Deref, str::FromStr};
 
 use alloy::{
-    primitives::{Address, PrimitiveSignature},
+    primitives::{aliases::B32, Address, PrimitiveSignature, B256},
     signers::{local::PrivateKeySigner, SignerSync},
 };
 use eyre::ensure;
@@ -9,8 +9,8 @@ use tree_hash::TreeHash;
 
 use crate::{
     constants::COMMIT_BOOST_DOMAIN,
-    signature::{compute_domain, compute_signing_root},
-    types::Chain,
+    signature::compute_domain,
+    types::{self, Chain},
 };
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
@@ -86,32 +86,44 @@ impl EcdsaSigner {
     pub async fn sign(
         &self,
         chain: Chain,
-        object_root: [u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<EcdsaSignature, alloy::signers::Error> {
         match self {
             EcdsaSigner::Local(sk) => {
-                let domain = compute_domain(chain, COMMIT_BOOST_DOMAIN);
-                let signing_root = compute_signing_root(object_root, domain).into();
+                let signing_domain = compute_domain(chain, &B32::from(COMMIT_BOOST_DOMAIN));
+                let signing_root = match module_signing_id {
+                    Some(id) => {
+                        let object_root = types::PropCommitSigningInfo {
+                            data: *object_root,
+                            module_signing_id: *id,
+                        }
+                        .tree_hash_root();
+                        types::SigningData { object_root, signing_domain }.tree_hash_root()
+                    }
+                    None => types::SigningData { object_root: *object_root, signing_domain }
+                        .tree_hash_root(),
+                };
                 sk.sign_hash_sync(&signing_root).map(EcdsaSignature::from)
             }
         }
     }
-
     pub async fn sign_msg(
         &self,
         chain: Chain,
         msg: &impl TreeHash,
+        module_signing_id: Option<&B256>,
     ) -> Result<EcdsaSignature, alloy::signers::Error> {
-        self.sign(chain, msg.tree_hash_root().0).await
+        self.sign(chain, &msg.tree_hash_root(), module_signing_id).await
     }
 }
 
 pub fn verify_ecdsa_signature(
     address: &Address,
-    msg: &[u8; 32],
+    msg: &B256,
     signature: &EcdsaSignature,
 ) -> eyre::Result<()> {
-    let recovered = signature.recover_address_from_prehash(msg.into())?;
+    let recovered = signature.recover_address_from_prehash(msg)?;
     ensure!(recovered == *address, "invalid signature");
     Ok(())
 }
@@ -124,15 +136,16 @@ mod test {
     use super::*;
 
     #[tokio::test]
-    async fn test_ecdsa_signer() {
+    async fn test_ecdsa_signer_noncommit() {
         let pk = bytes!("88bcd6672d95bcba0d52a3146494ed4d37675af4ed2206905eb161aa99a6c0d1");
         let signer = EcdsaSigner::new_from_bytes(&pk).unwrap();
 
-        let object_root = [1; 32];
-        let signature = signer.sign(Chain::Holesky, object_root).await.unwrap();
+        let object_root = B256::from([1; 32]);
+        let signature = signer.sign(Chain::Holesky, &object_root, None).await.unwrap();
 
-        let domain = compute_domain(Chain::Holesky, COMMIT_BOOST_DOMAIN);
-        let msg = compute_signing_root(object_root, domain);
+        let domain = compute_domain(Chain::Holesky, &B32::from(COMMIT_BOOST_DOMAIN));
+        let signing_data = types::SigningData { object_root, signing_domain: domain };
+        let msg = signing_data.tree_hash_root();
 
         assert_eq!(msg, hex!("219ca7a673b2cbbf67bec6c9f60f78bd051336d57b68d1540190f30667e86725"));
 
@@ -140,4 +153,26 @@ mod test {
         let verified = verify_ecdsa_signature(&address, &msg, &signature);
         assert!(verified.is_ok());
     }
+
+    #[tokio::test]
+    async fn test_ecdsa_signer_prop_commit() {
+        let pk = bytes!("88bcd6672d95bcba0d52a3146494ed4d37675af4ed2206905eb161aa99a6c0d1");
+        let signer = EcdsaSigner::new_from_bytes(&pk).unwrap();
+
+        let object_root = B256::from([1; 32]);
+        let module_signing_id = B256::from([2; 32]);
+        let signature =
+            signer.sign(Chain::Hoodi, &object_root, Some(&module_signing_id)).await.unwrap();
+
+        let signing_domain = compute_domain(Chain::Hoodi, &B32::from(COMMIT_BOOST_DOMAIN));
+        let object_root =
+            types::PropCommitSigningInfo { data: object_root, module_signing_id }.tree_hash_root();
+        let msg = types::SigningData { object_root, signing_domain }.tree_hash_root();
+
+        assert_eq!(msg, hex!("8cd49ccf2f9b0297796ff96ce5f7c5d26e20a59d0032ee2ad6249dcd9682b808"));
+
+        let address = signer.address();
+        let verified = verify_ecdsa_signature(&address, &msg, &signature);
+        assert!(verified.is_ok());
+    }
 }
diff --git a/crates/common/src/signer/store.rs b/crates/common/src/signer/store.rs
index 479a4016..834f4bd8 100644
--- a/crates/common/src/signer/store.rs
+++ b/crates/common/src/signer/store.rs
@@ -532,7 +532,8 @@ mod test {
             delegator: consensus_signer.pubkey(),
             proxy: proxy_signer.pubkey(),
         };
-        let signature = consensus_signer.sign(Chain::Mainnet, message.tree_hash_root().0).await;
+        let signature =
+            consensus_signer.sign(Chain::Mainnet, &message.tree_hash_root(), None).await;
         let delegation = SignedProxyDelegationBls { signature, message };
         let proxy_signer = BlsProxySigner { signer: proxy_signer, delegation };
 
@@ -645,7 +646,8 @@ mod test {
             delegator: consensus_signer.pubkey(),
             proxy: proxy_signer.pubkey(),
         };
-        let signature = consensus_signer.sign(Chain::Mainnet, message.tree_hash_root().0).await;
+        let signature =
+            consensus_signer.sign(Chain::Mainnet, &message.tree_hash_root(), None).await;
         let delegation = SignedProxyDelegationBls { signature, message };
         let proxy_signer = BlsProxySigner { signer: proxy_signer, delegation };
 
diff --git a/crates/common/src/types.rs b/crates/common/src/types.rs
index 3d07e89c..c747815b 100644
--- a/crates/common/src/types.rs
+++ b/crates/common/src/types.rs
@@ -1,9 +1,10 @@
 use std::path::PathBuf;
 
-use alloy::primitives::{hex, Bytes};
+use alloy::primitives::{aliases::B32, hex, Bytes, B256};
 use derive_more::{Deref, Display, From, Into};
 use eyre::{bail, Context};
 use serde::{Deserialize, Serialize};
+use tree_hash_derive::TreeHash;
 
 use crate::{constants::APPLICATION_BUILDER_DOMAIN, signature::compute_domain};
 
@@ -84,14 +85,14 @@ impl Chain {
         }
     }
 
-    pub fn builder_domain(&self) -> [u8; 32] {
+    pub fn builder_domain(&self) -> B256 {
         match self {
             Chain::Mainnet => KnownChain::Mainnet.builder_domain(),
             Chain::Holesky => KnownChain::Holesky.builder_domain(),
             Chain::Sepolia => KnownChain::Sepolia.builder_domain(),
             Chain::Helder => KnownChain::Helder.builder_domain(),
             Chain::Hoodi => KnownChain::Hoodi.builder_domain(),
-            Chain::Custom { .. } => compute_domain(*self, APPLICATION_BUILDER_DOMAIN),
+            Chain::Custom { .. } => compute_domain(*self, &B32::from(APPLICATION_BUILDER_DOMAIN)),
         }
     }
 
@@ -155,28 +156,28 @@ impl KnownChain {
         }
     }
 
-    pub fn builder_domain(&self) -> [u8; 32] {
+    pub fn builder_domain(&self) -> B256 {
         match self {
-            KnownChain::Mainnet => [
+            KnownChain::Mainnet => B256::from([
                 0, 0, 0, 1, 245, 165, 253, 66, 209, 106, 32, 48, 39, 152, 239, 110, 211, 9, 151,
                 155, 67, 0, 61, 35, 32, 217, 240, 232, 234, 152, 49, 169,
-            ],
-            KnownChain::Holesky => [
+            ]),
+            KnownChain::Holesky => B256::from([
                 0, 0, 0, 1, 91, 131, 162, 55, 89, 197, 96, 178, 208, 198, 69, 118, 225, 220, 252,
                 52, 234, 148, 196, 152, 143, 62, 13, 159, 119, 240, 83, 135,
-            ],
-            KnownChain::Sepolia => [
+            ]),
+            KnownChain::Sepolia => B256::from([
                 0, 0, 0, 1, 211, 1, 7, 120, 205, 8, 238, 81, 75, 8, 254, 103, 182, 197, 3, 181, 16,
                 152, 122, 76, 228, 63, 66, 48, 109, 151, 198, 124,
-            ],
-            KnownChain::Helder => [
+            ]),
+            KnownChain::Helder => B256::from([
                 0, 0, 0, 1, 148, 196, 26, 244, 132, 255, 247, 150, 73, 105, 224, 189, 217, 34, 248,
                 45, 255, 15, 75, 232, 122, 96, 208, 102, 76, 201, 209, 255,
-            ],
-            KnownChain::Hoodi => [
+            ]),
+            KnownChain::Hoodi => B256::from([
                 0, 0, 0, 1, 113, 145, 3, 81, 30, 250, 79, 19, 98, 255, 42, 80, 153, 108, 204, 243,
                 41, 204, 132, 203, 65, 12, 94, 92, 125, 53, 29, 3,
-            ],
+            ]),
         }
     }
 
@@ -289,6 +290,22 @@ impl<'de> Deserialize<'de> for Chain {
     }
 }
 
+/// Structure for signatures used in Beacon chain operations
+#[derive(Default, Debug, TreeHash)]
+pub struct SigningData {
+    pub object_root: B256,
+    pub signing_domain: B256,
+}
+
+/// Structure for signatures used for proposer commitments in Commit Boost.
+/// The signing root of this struct must be used as the object_root of a
+/// SigningData for signatures.
+#[derive(Default, Debug, TreeHash)]
+pub struct PropCommitSigningInfo {
+    pub data: B256,
+    pub module_signing_id: B256,
+}
+
 /// Returns seconds_per_slot and genesis_fork_version from a spec, such as
 /// returned by /eth/v1/config/spec ref: https://ethereum.github.io/beacon-APIs/#/Config/getSpec
 /// Try to load two formats:
diff --git a/crates/pbs/src/mev_boost/get_header.rs b/crates/pbs/src/mev_boost/get_header.rs
index 613815ce..1adcb74a 100644
--- a/crates/pbs/src/mev_boost/get_header.rs
+++ b/crates/pbs/src/mev_boost/get_header.rs
@@ -4,7 +4,7 @@ use std::{
 };
 
 use alloy::{
-    primitives::{utils::format_ether, B256, U256},
+    primitives::{aliases::B32, utils::format_ether, B256, U256},
     providers::Provider,
     rpc::types::{beacon::BlsPublicKey, Block},
 };
@@ -475,7 +475,8 @@ fn validate_signature<T: TreeHash>(
         &received_relay_pubkey,
         &message,
         signature,
-        APPLICATION_BUILDER_DOMAIN,
+        None,
+        &B32::from(APPLICATION_BUILDER_DOMAIN),
     )
     .map_err(ValidationError::Sigverify)?;
 
diff --git a/crates/signer/src/error.rs b/crates/signer/src/error.rs
index b0fc88de..64a3e5b8 100644
--- a/crates/signer/src/error.rs
+++ b/crates/signer/src/error.rs
@@ -33,6 +33,9 @@ pub enum SignerModuleError {
 
     #[error("rate limited for {0} more seconds")]
     RateLimited(f64),
+
+    #[error("request error: {0}")]
+    RequestError(String),
 }
 
 impl IntoResponse for SignerModuleError {
@@ -55,6 +58,9 @@ impl IntoResponse for SignerModuleError {
             SignerModuleError::RateLimited(duration) => {
                 (StatusCode::TOO_MANY_REQUESTS, format!("rate limited for {duration:?}"))
             }
+            SignerModuleError::RequestError(err) => {
+                (StatusCode::BAD_REQUEST, format!("bad request: {err}"))
+            }
         }
         .into_response()
     }
diff --git a/crates/signer/src/manager/dirk.rs b/crates/signer/src/manager/dirk.rs
index 4c2d909f..add9e3a2 100644
--- a/crates/signer/src/manager/dirk.rs
+++ b/crates/signer/src/manager/dirk.rs
@@ -1,6 +1,10 @@
 use std::{collections::HashMap, io::Write, path::PathBuf};
 
-use alloy::{hex, rpc::types::beacon::constants::BLS_SIGNATURE_BYTES_LEN};
+use alloy::{
+    hex,
+    primitives::{aliases::B32, B256},
+    rpc::types::beacon::constants::BLS_SIGNATURE_BYTES_LEN,
+};
 use blsful::inner_types::{Field, G2Affine, G2Projective, Group, Scalar};
 use cb_common::{
     commit::request::{ConsensusProxyMap, ProxyDelegation, SignedProxyDelegation},
@@ -8,7 +12,7 @@ use cb_common::{
     constants::COMMIT_BOOST_DOMAIN,
     signature::compute_domain,
     signer::{BlsPublicKey, BlsSignature, ProxyStore},
-    types::{Chain, ModuleId},
+    types::{self, Chain, ModuleId},
 };
 use eyre::{bail, OptionExt};
 use futures::{future::join_all, stream::FuturesUnordered, FutureExt, StreamExt};
@@ -192,14 +196,15 @@ impl DirkManager {
     pub async fn request_consensus_signature(
         &self,
         pubkey: &BlsPublicKey,
-        object_root: [u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<BlsSignature, SignerModuleError> {
         match self.consensus_accounts.get(pubkey) {
             Some(Account::Simple(account)) => {
-                self.request_simple_signature(account, object_root).await
+                self.request_simple_signature(account, object_root, module_signing_id).await
             }
             Some(Account::Distributed(account)) => {
-                self.request_distributed_signature(account, object_root).await
+                self.request_distributed_signature(account, object_root, module_signing_id).await
             }
             None => Err(SignerModuleError::UnknownConsensusSigner(pubkey.to_vec())),
         }
@@ -209,14 +214,15 @@ impl DirkManager {
     pub async fn request_proxy_signature(
         &self,
         pubkey: &BlsPublicKey,
-        object_root: [u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<BlsSignature, SignerModuleError> {
         match self.proxy_accounts.get(pubkey) {
             Some(ProxyAccount { inner: Account::Simple(account), .. }) => {
-                self.request_simple_signature(account, object_root).await
+                self.request_simple_signature(account, object_root, module_signing_id).await
             }
             Some(ProxyAccount { inner: Account::Distributed(account), .. }) => {
-                self.request_distributed_signature(account, object_root).await
+                self.request_distributed_signature(account, object_root, module_signing_id).await
             }
             None => Err(SignerModuleError::UnknownProxySigner(pubkey.to_vec())),
         }
@@ -226,13 +232,21 @@ impl DirkManager {
     async fn request_simple_signature(
         &self,
         account: &SimpleAccount,
-        object_root: [u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<BlsSignature, SignerModuleError> {
-        let domain = compute_domain(self.chain, COMMIT_BOOST_DOMAIN);
+        let domain = compute_domain(self.chain, &B32::from(COMMIT_BOOST_DOMAIN));
+
+        let data = match module_signing_id {
+            Some(id) => types::PropCommitSigningInfo { data: *object_root, module_signing_id: *id }
+                .tree_hash_root()
+                .to_vec(),
+            None => object_root.to_vec(),
+        };
 
         let response = SignerClient::new(account.connection.clone())
             .sign(SignRequest {
-                data: object_root.to_vec(),
+                data,
                 domain: domain.to_vec(),
                 id: Some(sign_request::Id::PublicKey(account.public_key.to_vec())),
             })
@@ -256,17 +270,27 @@ impl DirkManager {
     async fn request_distributed_signature(
         &self,
         account: &DistributedAccount,
-        object_root: [u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<BlsSignature, SignerModuleError> {
         let mut partials = Vec::with_capacity(account.participants.len());
         let mut requests = Vec::with_capacity(account.participants.len());
 
+        let data = match module_signing_id {
+            Some(id) => types::PropCommitSigningInfo { data: *object_root, module_signing_id: *id }
+                .tree_hash_root()
+                .to_vec(),
+            None => object_root.to_vec(),
+        };
+
         for (id, channel) in account.participants.iter() {
+            let data_copy = data.clone();
             let request = async move {
                 SignerClient::new(channel.clone())
                     .sign(SignRequest {
-                        data: object_root.to_vec(),
-                        domain: compute_domain(self.chain, COMMIT_BOOST_DOMAIN).to_vec(),
+                        data: data_copy,
+                        domain: compute_domain(self.chain, &B32::from(COMMIT_BOOST_DOMAIN))
+                            .to_vec(),
                         id: Some(sign_request::Id::Account(account.name.clone())),
                     })
                     .map(|res| (res, *id))
@@ -336,7 +360,7 @@ impl DirkManager {
         let message =
             ProxyDelegation { delegator: consensus, proxy: proxy_account.inner.public_key() };
         let delegation_signature =
-            self.request_consensus_signature(&consensus, message.tree_hash_root().0).await?;
+            self.request_consensus_signature(&consensus, &message.tree_hash_root(), None).await?;
 
         let delegation = SignedProxyDelegation { message, signature: delegation_signature };
 
diff --git a/crates/signer/src/manager/local.rs b/crates/signer/src/manager/local.rs
index a613df0a..a13695e5 100644
--- a/crates/signer/src/manager/local.rs
+++ b/crates/signer/src/manager/local.rs
@@ -1,6 +1,9 @@
 use std::collections::HashMap;
 
-use alloy::{primitives::Address, rpc::types::beacon::BlsSignature};
+use alloy::{
+    primitives::{Address, B256},
+    rpc::types::beacon::BlsSignature,
+};
 use cb_common::{
     commit::request::{
         ConsensusProxyMap, ProxyDelegationBls, ProxyDelegationEcdsa, SignedProxyDelegationBls,
@@ -95,7 +98,7 @@ impl LocalSigningManager {
         let proxy_pubkey = signer.pubkey();
 
         let message = ProxyDelegationBls { delegator, proxy: proxy_pubkey };
-        let signature = self.sign_consensus(&delegator, &message.tree_hash_root().0).await?;
+        let signature = self.sign_consensus(&delegator, &message.tree_hash_root(), None).await?;
         let delegation = SignedProxyDelegationBls { signature, message };
         let proxy_signer = BlsProxySigner { signer, delegation };
 
@@ -114,7 +117,7 @@ impl LocalSigningManager {
         let proxy_address = signer.address();
 
         let message = ProxyDelegationEcdsa { delegator, proxy: proxy_address };
-        let signature = self.sign_consensus(&delegator, &message.tree_hash_root().0).await?;
+        let signature = self.sign_consensus(&delegator, &message.tree_hash_root(), None).await?;
         let delegation = SignedProxyDelegationEcdsa { signature, message };
         let proxy_signer = EcdsaProxySigner { signer, delegation };
 
@@ -129,13 +132,14 @@ impl LocalSigningManager {
     pub async fn sign_consensus(
         &self,
         pubkey: &BlsPublicKey,
-        object_root: &[u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<BlsSignature, SignerModuleError> {
         let signer = self
             .consensus_signers
             .get(pubkey)
             .ok_or(SignerModuleError::UnknownConsensusSigner(pubkey.to_vec()))?;
-        let signature = signer.sign(self.chain, *object_root).await;
+        let signature = signer.sign(self.chain, object_root, module_signing_id).await;
 
         Ok(signature)
     }
@@ -143,28 +147,30 @@ impl LocalSigningManager {
     pub async fn sign_proxy_bls(
         &self,
         pubkey: &BlsPublicKey,
-        object_root: &[u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<BlsSignature, SignerModuleError> {
         let bls_proxy = self
             .proxy_signers
             .bls_signers
             .get(pubkey)
             .ok_or(SignerModuleError::UnknownProxySigner(pubkey.to_vec()))?;
-        let signature = bls_proxy.sign(self.chain, *object_root).await;
+        let signature = bls_proxy.sign(self.chain, object_root, module_signing_id).await;
         Ok(signature)
     }
 
     pub async fn sign_proxy_ecdsa(
         &self,
         address: &Address,
-        object_root: &[u8; 32],
+        object_root: &B256,
+        module_signing_id: Option<&B256>,
     ) -> Result<EcdsaSignature, SignerModuleError> {
         let ecdsa_proxy = self
             .proxy_signers
             .ecdsa_signers
             .get(address)
             .ok_or(SignerModuleError::UnknownProxySigner(address.to_vec()))?;
-        let signature = ecdsa_proxy.sign(self.chain, *object_root).await?;
+        let signature = ecdsa_proxy.sign(self.chain, object_root, module_signing_id).await?;
         Ok(signature)
     }
 
@@ -265,7 +271,6 @@ impl LocalSigningManager {
 #[cfg(test)]
 mod tests {
     use alloy::primitives::B256;
-    use cb_common::signature::compute_signing_root;
     use lazy_static::lazy_static;
 
     use super::*;
@@ -287,9 +292,48 @@ mod tests {
         (signing_manager, consensus_pk)
     }
 
+    mod test_bls {
+        use alloy::primitives::aliases::B32;
+        use cb_common::{
+            constants::COMMIT_BOOST_DOMAIN, signature::compute_domain,
+            signer::verify_bls_signature, types,
+        };
+
+        use super::*;
+
+        #[tokio::test]
+        async fn test_key_signs_message() {
+            let (signing_manager, consensus_pk) = init_signing_manager();
+
+            let data_root = B256::random();
+            let module_signing_id = B256::random();
+
+            let sig = signing_manager
+                .sign_consensus(&consensus_pk, &data_root, Some(&module_signing_id))
+                .await
+                .unwrap();
+
+            // Verify signature
+            let signing_domain = compute_domain(CHAIN, &B32::from(COMMIT_BOOST_DOMAIN));
+            let object_root = types::PropCommitSigningInfo {
+                data: data_root.tree_hash_root(),
+                module_signing_id,
+            }
+            .tree_hash_root();
+            let signing_root = types::SigningData { object_root, signing_domain }.tree_hash_root();
+
+            let validation_result =
+                verify_bls_signature(&consensus_pk, signing_root.as_slice(), &sig);
+
+            assert!(validation_result.is_ok(), "Keypair must produce valid signatures of messages.")
+        }
+    }
+
     mod test_proxy_bls {
+        use alloy::primitives::aliases::B32;
         use cb_common::{
-            constants::COMMIT_BOOST_DOMAIN, signature::compute_domain, signer::verify_bls_signature,
+            constants::COMMIT_BOOST_DOMAIN, signature::compute_domain,
+            signer::verify_bls_signature, types,
         };
 
         use super::*;
@@ -339,14 +383,23 @@ mod tests {
             let proxy_pk = signed_delegation.message.proxy;
 
             let data_root = B256::random();
+            let module_signing_id = B256::random();
 
-            let sig = signing_manager.sign_proxy_bls(&proxy_pk, &data_root).await.unwrap();
+            let sig = signing_manager
+                .sign_proxy_bls(&proxy_pk, &data_root, Some(&module_signing_id))
+                .await
+                .unwrap();
 
             // Verify signature
-            let domain = compute_domain(CHAIN, COMMIT_BOOST_DOMAIN);
-            let signing_root = compute_signing_root(data_root.tree_hash_root().0, domain);
+            let signing_domain = compute_domain(CHAIN, &B32::from(COMMIT_BOOST_DOMAIN));
+            let object_root = types::PropCommitSigningInfo {
+                data: data_root.tree_hash_root(),
+                module_signing_id,
+            }
+            .tree_hash_root();
+            let signing_root = types::SigningData { object_root, signing_domain }.tree_hash_root();
 
-            let validation_result = verify_bls_signature(&proxy_pk, &signing_root, &sig);
+            let validation_result = verify_bls_signature(&proxy_pk, signing_root.as_slice(), &sig);
 
             assert!(
                 validation_result.is_ok(),
@@ -356,9 +409,10 @@ mod tests {
     }
 
     mod test_proxy_ecdsa {
+        use alloy::primitives::aliases::B32;
         use cb_common::{
             constants::COMMIT_BOOST_DOMAIN, signature::compute_domain,
-            signer::verify_ecdsa_signature,
+            signer::verify_ecdsa_signature, types,
         };
 
         use super::*;
@@ -408,12 +462,21 @@ mod tests {
             let proxy_pk = signed_delegation.message.proxy;
 
             let data_root = B256::random();
+            let module_signing_id = B256::random();
 
-            let sig = signing_manager.sign_proxy_ecdsa(&proxy_pk, &data_root).await.unwrap();
+            let sig = signing_manager
+                .sign_proxy_ecdsa(&proxy_pk, &data_root, Some(&module_signing_id))
+                .await
+                .unwrap();
 
             // Verify signature
-            let domain = compute_domain(CHAIN, COMMIT_BOOST_DOMAIN);
-            let signing_root = compute_signing_root(data_root.tree_hash_root().0, domain);
+            let signing_domain = compute_domain(CHAIN, &B32::from(COMMIT_BOOST_DOMAIN));
+            let object_root = types::PropCommitSigningInfo {
+                data: data_root.tree_hash_root(),
+                module_signing_id,
+            }
+            .tree_hash_root();
+            let signing_root = types::SigningData { object_root, signing_domain }.tree_hash_root();
 
             let validation_result = verify_ecdsa_signature(&proxy_pk, &signing_root, &sig);
 
diff --git a/crates/signer/src/service.rs b/crates/signer/src/service.rs
index 59da3c3d..4ecf5e75 100644
--- a/crates/signer/src/service.rs
+++ b/crates/signer/src/service.rs
@@ -25,7 +25,7 @@ use cb_common::{
             RevokeModuleRequest, SignConsensusRequest, SignProxyRequest, SignRequest,
         },
     },
-    config::StartSignerConfig,
+    config::{ModuleSigningConfig, StartSignerConfig},
     constants::{COMMIT_BOOST_COMMIT, COMMIT_BOOST_VERSION},
     types::{Chain, Jwt, ModuleId},
     utils::{decode_jwt, validate_admin_jwt, validate_jwt},
@@ -61,9 +61,10 @@ struct SigningState {
     /// Manager handling different signing methods
     manager: Arc<RwLock<SigningManager>>,
 
-    /// Map of modules ids to JWT secrets. This also acts as registry of all
-    /// modules running
-    jwts: Arc<ParkingRwLock<HashMap<ModuleId, String>>>,
+    /// Map of modules ids to JWT configurations. This also acts as registry of
+    /// all modules running
+    jwts: Arc<ParkingRwLock<HashMap<ModuleId, ModuleSigningConfig>>>,
+
     /// Secret for the admin JWT
     admin_secret: Arc<ParkingRwLock<String>>,
 
@@ -77,16 +78,17 @@ struct SigningState {
 
 impl SigningService {
     pub async fn run(config: StartSignerConfig) -> eyre::Result<()> {
-        if config.jwts.is_empty() {
+        if config.mod_signing_configs.is_empty() {
             warn!("Signing service was started but no module is registered. Exiting");
             return Ok(());
         }
 
-        let module_ids: Vec<String> = config.jwts.keys().cloned().map(Into::into).collect();
+        let module_ids: Vec<String> =
+            config.mod_signing_configs.keys().cloned().map(Into::into).collect();
 
         let state = SigningState {
             manager: Arc::new(RwLock::new(start_manager(config.clone()).await?)),
-            jwts: Arc::new(ParkingRwLock::new(config.jwts)),
+            jwts: Arc::new(ParkingRwLock::new(config.mod_signing_configs)),
             admin_secret: Arc::new(ParkingRwLock::new(config.admin_secret)),
             jwt_auth_failures: Arc::new(ParkingRwLock::new(HashMap::new())),
             jwt_auth_fail_limit: config.jwt_auth_fail_limit,
@@ -228,12 +230,12 @@ fn check_jwt_auth(
     })?;
 
     let guard = state.jwts.read();
-    let jwt_secret = guard.get(&module_id).ok_or_else(|| {
+    let jwt_config = guard.get(&module_id).ok_or_else(|| {
         error!("Unauthorized request. Was the module started correctly?");
         SignerModuleError::Unauthorized
     })?;
 
-    validate_jwt(jwt, jwt_secret).map_err(|e| {
+    validate_jwt(jwt, &jwt_config.jwt_secret).map_err(|e| {
         error!("Unauthorized request. Invalid JWT: {e}");
         SignerModuleError::Unauthorized
     })?;
@@ -298,37 +300,48 @@ async fn handle_request_signature(
 ) -> Result<impl IntoResponse, SignerModuleError> {
     let req_id = Uuid::new_v4();
 
+    let Some(signing_id) = state.jwts.read().get(&module_id).map(|m| m.signing_id) else {
+        error!(event = "request_signature", ?module_id, ?req_id, "Module signing ID not found");
+        return Err(SignerModuleError::RequestError("Module signing ID not found".to_string()));
+    };
+
     debug!(event = "request_signature", ?module_id, %request, ?req_id, "New request");
 
     let manager = state.manager.read().await;
     let res = match &*manager {
         SigningManager::Local(local_manager) => match request {
-            SignRequest::Consensus(SignConsensusRequest { object_root, pubkey }) => local_manager
-                .sign_consensus(&pubkey, &object_root)
-                .await
-                .map(|sig| Json(sig).into_response()),
-            SignRequest::ProxyBls(SignProxyRequest { object_root, proxy: bls_key }) => {
+            SignRequest::Consensus(SignConsensusRequest { ref object_root, ref pubkey }) => {
+                local_manager
+                    .sign_consensus(pubkey, object_root, Some(&signing_id))
+                    .await
+                    .map(|sig| Json(sig).into_response())
+            }
+            SignRequest::ProxyBls(SignProxyRequest { ref object_root, proxy: ref bls_key }) => {
                 local_manager
-                    .sign_proxy_bls(&bls_key, &object_root)
+                    .sign_proxy_bls(bls_key, object_root, Some(&signing_id))
                     .await
                     .map(|sig| Json(sig).into_response())
             }
-            SignRequest::ProxyEcdsa(SignProxyRequest { object_root, proxy: ecdsa_key }) => {
+            SignRequest::ProxyEcdsa(SignProxyRequest { ref object_root, proxy: ref ecdsa_key }) => {
                 local_manager
-                    .sign_proxy_ecdsa(&ecdsa_key, &object_root)
+                    .sign_proxy_ecdsa(ecdsa_key, object_root, Some(&signing_id))
                     .await
                     .map(|sig| Json(sig).into_response())
             }
         },
         SigningManager::Dirk(dirk_manager) => match request {
-            SignRequest::Consensus(SignConsensusRequest { object_root, pubkey }) => dirk_manager
-                .request_consensus_signature(&pubkey, *object_root)
-                .await
-                .map(|sig| Json(sig).into_response()),
-            SignRequest::ProxyBls(SignProxyRequest { object_root, proxy: bls_key }) => dirk_manager
-                .request_proxy_signature(&bls_key, *object_root)
-                .await
-                .map(|sig| Json(sig).into_response()),
+            SignRequest::Consensus(SignConsensusRequest { ref object_root, ref pubkey }) => {
+                dirk_manager
+                    .request_consensus_signature(pubkey, object_root, Some(&signing_id))
+                    .await
+                    .map(|sig| Json(sig).into_response())
+            }
+            SignRequest::ProxyBls(SignProxyRequest { ref object_root, proxy: ref bls_key }) => {
+                dirk_manager
+                    .request_proxy_signature(bls_key, object_root, Some(&signing_id))
+                    .await
+                    .map(|sig| Json(sig).into_response())
+            }
             SignRequest::ProxyEcdsa(_) => {
                 error!(
                     event = "request_signature",
@@ -405,7 +418,24 @@ async fn handle_reload(
     };
 
     if let Some(jwt_secrets) = request.jwt_secrets {
-        *state.jwts.write() = jwt_secrets;
+        let mut jwt_configs = state.jwts.write();
+        let mut new_configs = HashMap::new();
+        for (module_id, jwt_secret) in jwt_secrets {
+            if let Some(signing_id) = jwt_configs.get(&module_id).map(|cfg| cfg.signing_id) {
+                new_configs.insert(module_id.clone(), ModuleSigningConfig {
+                    module_name: module_id,
+                    jwt_secret,
+                    signing_id,
+                });
+            } else {
+                let error_message = format!(
+                    "Module {module_id} signing ID not found in commit-boost config, cannot reload"
+                );
+                error!(event = "reload", ?req_id, module_id = %module_id, error = %error_message);
+                return Err(SignerModuleError::RequestError(error_message));
+            }
+        }
+        *jwt_configs = new_configs;
     }
 
     if let Some(admin_secret) = request.admin_secret {
diff --git a/docs/docs/developing/prop-commit-signing.md b/docs/docs/developing/prop-commit-signing.md
new file mode 100644
index 00000000..fd19fafc
--- /dev/null
+++ b/docs/docs/developing/prop-commit-signing.md
@@ -0,0 +1,60 @@
+# Requesting Proposer Commitment Signatures with Commit-Boost
+
+When you create a new validator on the Ethereum network, one of the steps is the generation of a new BLS private key (commonly known as the "validator key" or the "signer key") and its corresponding BLS public key (the "validator pubkey", used as an identifier). Typically this private key will be used by an Ethereum consensus client to sign things such as attestations and blocks for publication on the Beacon chain. These signatures prove that you, as the owner of that private key, approve of the data being signed. However, as general-purpose private keys, they can also be used to sign *other* arbitrary messages not destined for the Beacon chain.
+
+Commit-Boost takes advantage of this by offering a standard known as **proposer commitments**. These are arbitrary messages (albeit with some important rules), similar to the kind used on the Beacon chain, that have been signed by one of the owner's private keys. Modules interested in leveraging Commit-Boost's proposer commitments can construct their own data in whatever format they like and request that Commit-Boost's **signer service** generate a signature for it with a particular private key. The module can then use that signature to verify the data was signed by that user.
+
+Commit-Boost supports proposer commitment signatures for both BLS private keys (identified by their public key) and ECDSA private keys (identified by their Ethereum address).
+
+
+## Rules of Proposer Commitment Signatures
+
+Proposer commitment signatures produced by Commit-Boost's signer service conform to the following rules:
+
+- Signatures are **unique** to a given EVM chain (identified by its [chain ID](https://chainlist.org/)). Signatures generated for one chain will not work on a different chain.
+- Signatures are **unique** to Commit-Boost proposer commitments. The signer service **cannot** be used to create signatures that could be used for other applications, such as for attestations on the Beacon chain. While the signer service has access to the same validator private keys used to attest on the Beacon chain, it cannot create signatures that would get you slashed on the Beacon chain.
+- Signatures are **unique** to a particular module. One module cannot, for example, request an identical payload as another module and effectively "forge" a signature for the second module; identical payloads from two separate modules will result in two separate signatures.
+- The data payload being signed must be a **32-byte array**, typically serializd as a 64-character hex string with an optional `0x` prefix. The value itself is arbitrary, as long as it has meaning to the requester - though it is typically the 256-bit hash of some kind of data.
+- If requesting a signature from a BLS key, the resulting signature will be a standard BLS signature (96 bytes in length).
+- If requesting a signature from an ECDSA key, the resulting signature will be a standard Ethereum RSV signature (65 bytes in length).
+
+
+## Configuring a Module for Proposer Commitments
+
+Commit-Boost's signer service must be configured prior to launching to expect requests from your module. There are two main parts:
+
+1. An entry for your module into [Commit-Boost's configuration file](../get_started/configuration.md#custom-module). This must include a unique ID for your module, the line `type = "commit"`, and include a unique [signing ID](#the-signing-id) for your module. Generally you should provide values for these in your documentation, so your users can reference it when configuring their own Commit-Boost node.
+
+2. A JWT secret used by your module to authenticate with the signer in HTTP requests. This must be a string that both the Commit-Boost signer can read and your module can read, but no other modules should be allowed to access it. The user should be responsible for determining an appropriate secret and providing it to the Commit-Boost signer service securely; your module will need some way to accept this, typically via a command line argument that accepts a path to a file with the secret or as an environment variable.
+
+Once the user has configured both Commit-Boost and your module with these settings, your module will be able to authenticate with the signer service and request signatures.
+
+
+## The Signing ID
+
+Your module's signing ID is a 32-byte value that is used as a unique identifier within the signing process. Proposer commitment signatures incorporate this value along with the data being signed as a way to create signatures that are exclusive to your module, so other modules can't maliciously construct signatures that appear to be from your module. Your module must have this ID incorporated into itself ahead of time, and the user must include this same ID within their Commit-Boost configuration file section for your module. Commit-Boost does not maintain a global registry of signing IDs, so this is a value you should provide to your users in your documentation.
+
+The Signing ID is decoupled from your module's human-readable name (the `module_id` field in the Commit-Boost configuration file) so that any changes to your module name will not invalidate signatures from previous versions. Similarly, if you don't change the module ID but *want* to invalidate previous signatures, you can modify the signing ID and it will do so. Just ensure your users are made aware of the change, so they can update it in their Commit-Boost configuration files accordingly.
+
+
+## Structure of a Signature
+
+The form proposer commitment signatures take depends on the type of signature being requested. BLS signatures take the [standard form](https://eth2book.info/latest/part2/building_blocks/signatures/) (96-byte values). ECDSA (Ethereum EL) signatures take the [standard Ethereum ECDSA `r,s,v` signature form](https://forum.openzeppelin.com/t/sign-it-like-you-mean-it-creating-and-verifying-ethereum-signatures/697). In both cases, the data being signed is a 32-byte hash - the root hash of an SSZ Merkle tree, described below:
+
+<center>
+
+<img src="../res/img/prop_commit_tree.png" width="800"/>
+
+</center>
+
+where:
+
+- `Request Data` is a 32-byte array that serves as the data you want to sign. This is typically a hash of some more complex data on its own that your module constructs.
+
+- `Signing ID` is your module's 32-byte signing ID. The signer service will load this for your module from its configuration file.
+
+- `Domain` is the 32-byte output of the [compute_domain()](https://eth2book.info/capella/part2/building_blocks/signatures/#domain-separation-and-forks) function in the Beacon specification. The 4-byte domain type in this case is not a standard Beacon domain type, but rather Commit-Boost's own domain type: `0x6D6D6F43`.
+
+The data signed in a proposer commitment is the 32-byte root of this tree (the green `Root` box). Note that calculating this will involve calculating the Merkle Root of two separate trees: first the blue data subtree (with the original request data and the signing ID) to establish the blue `Root` value, and then again with a tree created from that value and the `Domain`. 
+
+Many languages provide libraries for computing the root of an SSZ Merkle tree, such as [fastssz for Go](https://github.com/ferranbt/fastssz) or [tree_hash for Rust](https://docs.rs/tree_hash/latest/tree_hash/). When verifying proposer commitment signatures, use a library that supports Merkle tree root hashing, the `compute_domain()` operation, and validation for signatures generated by your key of choice.
diff --git a/docs/docs/get_started/configuration.md b/docs/docs/get_started/configuration.md
index 4448cd89..ed2ffa6e 100644
--- a/docs/docs/get_started/configuration.md
+++ b/docs/docs/get_started/configuration.md
@@ -341,6 +341,7 @@ Delegation signatures will be stored in files with the format `<proxy_dir>/deleg
 
 A full example of a config file with Dirk can be found [here](https://github.com/Commit-Boost/commit-boost-client/blob/main/examples/configs/dirk_signer.toml).
 
+
 ## Custom module
 We currently provide a test module that needs to be built locally. To build the module run:
 ```bash
@@ -375,6 +376,7 @@ enabled = true
 id = "DA_COMMIT"
 type = "commit"
 docker_image = "test_da_commit"
+signing_id = "0x6a33a23ef26a4836979edff86c493a69b26ccf0b4a16491a815a13787657431b"
 sleep_secs = 5
 
 [[modules]]
@@ -385,10 +387,11 @@ docker_image = "test_builder_log"
 
 A few things to note:
 - We now added a `signer` section which will be used to create the Signer module.
-- There is now a `[[modules]]` section which at a minimum needs to specify the module `id`, `type` and `docker_image`. Additional parameters needed for the business logic of the module will also be here,
+- There is now a `[[modules]]` section which at a minimum needs to specify the module `id`, `type` and `docker_image`. For modules with type `commit`, which will be used to access the Signer service and request signatures for preconfs, you will also need to specify the module's unique `signing_id` (see [the propser commitment documentation](../developing/prop-commit-signing.md)). Additional parameters needed for the business logic of the module will also be here.
 
 To learn more about developing modules, check out [here](/category/developing).
 
+
 ## Vouch
 [Vouch](https://github.com/attestantio/vouch) is a multi-node validator client built by [Attestant](https://www.attestant.io/). Vouch is particular in that it also integrates an MEV-Boost client to interact with relays. The Commit-Boost PBS module is compatible with the Vouch `blockrelay` since it implements the same Builder-API as relays. For example, depending on your setup and preference, you may want to fetch headers from a given relay using Commit-Boost vs using the built-in Vouch `blockrelay`.
 
diff --git a/docs/docs/res/img/prop_commit_tree.png b/docs/docs/res/img/prop_commit_tree.png
new file mode 100644
index 00000000..1e36f4b4
Binary files /dev/null and b/docs/docs/res/img/prop_commit_tree.png differ
diff --git a/examples/da_commit/src/main.rs b/examples/da_commit/src/main.rs
index 71b61c53..c73b2191 100644
--- a/examples/da_commit/src/main.rs
+++ b/examples/da_commit/src/main.rs
@@ -1,6 +1,6 @@
 use std::time::Duration;
 
-use alloy::primitives::Address;
+use alloy::primitives::{b256, Address, B256};
 use commit_boost::prelude::*;
 use eyre::{OptionExt, Result};
 use lazy_static::lazy_static;
@@ -9,6 +9,13 @@ use serde::Deserialize;
 use tokio::time::sleep;
 use tracing::{error, info};
 
+// This is the signing ID used for the DA Commit module.
+// Signatures produced by the signer service will incorporate this ID as part of
+// the signature, preventing other modules from using the same signature for
+// different purposes.
+pub const DA_COMMIT_SIGNING_ID: B256 =
+    b256!("0x6a33a23ef26a4836979edff86c493a69b26ccf0b4a16491a815a13787657431b");
+
 // You can define custom metrics and a custom registry for the business logic of
 // your module. These will be automatically scaped by the Prometheus server
 lazy_static! {
@@ -83,17 +90,38 @@ impl DaCommitService {
     ) -> Result<()> {
         let datagram = Datagram { data };
 
+        // Request a signature directly from a BLS key
         let request = SignConsensusRequest::builder(pubkey).with_msg(&datagram);
         let signature = self.config.signer_client.request_consensus_signature(request).await?;
-
         info!("Proposer commitment (consensus): {}", signature);
+        match verify_proposer_commitment_signature_bls(
+            self.config.chain,
+            &pubkey,
+            &datagram,
+            &signature,
+            &DA_COMMIT_SIGNING_ID,
+        ) {
+            Ok(_) => info!("Signature verified successfully"),
+            Err(err) => error!(%err, "Signature verification failed"),
+        };
 
+        // Request a signature from a proxy BLS key
         let proxy_request_bls = SignProxyRequest::builder(proxy_bls).with_msg(&datagram);
         let proxy_signature_bls =
             self.config.signer_client.request_proxy_signature_bls(proxy_request_bls).await?;
-
         info!("Proposer commitment (proxy BLS): {}", proxy_signature_bls);
+        match verify_proposer_commitment_signature_bls(
+            self.config.chain,
+            &proxy_bls,
+            &datagram,
+            &proxy_signature_bls,
+            &DA_COMMIT_SIGNING_ID,
+        ) {
+            Ok(_) => info!("Signature verified successfully"),
+            Err(err) => error!(%err, "Signature verification failed"),
+        };
 
+        // If ECDSA keys are enabled, request a signature from a proxy ECDSA key
         if let Some(proxy_ecdsa) = proxy_ecdsa {
             let proxy_request_ecdsa = SignProxyRequest::builder(proxy_ecdsa).with_msg(&datagram);
             let proxy_signature_ecdsa = self
@@ -102,6 +130,16 @@ impl DaCommitService {
                 .request_proxy_signature_ecdsa(proxy_request_ecdsa)
                 .await?;
             info!("Proposer commitment (proxy ECDSA): {}", proxy_signature_ecdsa);
+            match verify_proposer_commitment_signature_ecdsa(
+                self.config.chain,
+                &proxy_ecdsa,
+                &datagram,
+                &proxy_signature_ecdsa,
+                &DA_COMMIT_SIGNING_ID,
+            ) {
+                Ok(_) => info!("Signature verified successfully"),
+                Err(err) => error!(%err, "Signature verification failed"),
+            };
         }
 
         SIG_RECEIVED_COUNTER.inc();
diff --git a/tests/data/configs/signer.happy.toml b/tests/data/configs/signer.happy.toml
new file mode 100644
index 00000000..6fb76445
--- /dev/null
+++ b/tests/data/configs/signer.happy.toml
@@ -0,0 +1,52 @@
+chain = "Hoodi"
+
+[pbs]
+docker_image = "ghcr.io/commit-boost/pbs:latest"
+with_signer = true
+host = "127.0.0.1"
+port = 18550
+relay_check = true
+wait_all_registrations = true
+timeout_get_header_ms = 950
+timeout_get_payload_ms = 4000
+timeout_register_validator_ms = 3000
+skip_sigverify = false
+min_bid_eth = 0.5
+late_in_slot_time_ms = 2000
+extra_validation_enabled = false
+rpc_url = "https://ethereum-holesky-rpc.publicnode.com"
+
+[[relays]]
+id = "example-relay"
+url = "http://0xa1cec75a3f0661e99299274182938151e8433c61a19222347ea1313d839229cb4ce4e3e5aa2bdeb71c8fcf1b084963c2@abc.xyz"
+headers = { X-MyCustomHeader = "MyCustomHeader" }
+enable_timing_games = false
+target_first_request_ms = 200
+frequency_get_header_ms = 300
+
+[signer]
+docker_image = "ghcr.io/commit-boost/signer:latest"
+host = "127.0.0.1"
+port = 20000
+jwt_auth_fail_limit = 3
+jwt_auth_fail_timeout_seconds = 300
+
+[signer.local.loader]
+key_path = "./tests/data/keys.example.json"
+
+[signer.local.store]
+proxy_dir = "./proxies"
+
+[[modules]]
+id = "test-module"
+signing_id = "0x6a33a23ef26a4836979edff86c493a69b26ccf0b4a16491a815a13787657431b"
+type = "commit"
+docker_image = "test_da_commit"
+env_file = ".cb.env"
+
+[[modules]]
+id = "another-module"
+signing_id = "0x61fe00135d7b4912a8c63ada215ac2e62326e6e7b30f49a29fcf9779d7ad800d"
+type = "commit"
+docker_image = "test_da_commit"
+env_file = ".cb.env"
diff --git a/tests/src/lib.rs b/tests/src/lib.rs
index a4fbbb6a..54aedc46 100644
--- a/tests/src/lib.rs
+++ b/tests/src/lib.rs
@@ -1,3 +1,4 @@
 pub mod mock_relay;
 pub mod mock_validator;
+pub mod signer_service;
 pub mod utils;
diff --git a/tests/src/mock_relay.rs b/tests/src/mock_relay.rs
index 04ebfc24..414b82fe 100644
--- a/tests/src/mock_relay.rs
+++ b/tests/src/mock_relay.rs
@@ -121,8 +121,8 @@ async fn handle_get_header(
     response.message.pubkey = blst_pubkey_to_alloy(&state.signer.sk_to_pk());
     response.message.header.timestamp = timestamp_of_slot_start_sec(0, state.chain);
 
-    let object_root = response.message.tree_hash_root().0;
-    response.signature = sign_builder_root(state.chain, &state.signer, object_root);
+    let object_root = response.message.tree_hash_root();
+    response.signature = sign_builder_root(state.chain, &state.signer, &object_root);
 
     let response = GetHeaderResponse::Electra(response);
     (StatusCode::OK, Json(response)).into_response()
diff --git a/tests/src/signer_service.rs b/tests/src/signer_service.rs
new file mode 100644
index 00000000..5270e2a8
--- /dev/null
+++ b/tests/src/signer_service.rs
@@ -0,0 +1,87 @@
+use std::{collections::HashMap, time::Duration};
+
+use alloy::{hex, primitives::FixedBytes};
+use cb_common::{
+    commit::request::GetPubkeysResponse,
+    config::{ModuleSigningConfig, StartSignerConfig},
+    constants::SIGNER_JWT_EXPIRATION,
+    signer::{SignerLoader, ValidatorKeysFormat},
+    types::{Chain, Jwt, JwtAdmin, ModuleId},
+};
+use cb_signer::service::SigningService;
+use eyre::Result;
+use reqwest::{Response, StatusCode};
+use tracing::info;
+
+use crate::utils::{get_signer_config, get_start_signer_config};
+
+// Starts the signer moduler server on a separate task and returns its
+// configuration
+pub async fn start_server(
+    port: u16,
+    mod_signing_configs: &HashMap<ModuleId, ModuleSigningConfig>,
+    admin_secret: String,
+) -> Result<StartSignerConfig> {
+    let chain = Chain::Hoodi;
+
+    // Create a signer config
+    let loader = SignerLoader::ValidatorsDir {
+        keys_path: "data/keystores/keys".into(),
+        secrets_path: "data/keystores/secrets".into(),
+        format: ValidatorKeysFormat::Lighthouse,
+    };
+    let mut config = get_signer_config(loader);
+    config.port = port;
+    config.jwt_auth_fail_limit = 3; // Set a low fail limit for testing
+    config.jwt_auth_fail_timeout_seconds = 3; // Set a short timeout for testing
+    let start_config = get_start_signer_config(config, chain, mod_signing_configs, admin_secret);
+
+    // Run the Signer
+    let server_handle = tokio::spawn(SigningService::run(start_config.clone()));
+
+    // Make sure the server is running
+    tokio::time::sleep(Duration::from_millis(100)).await;
+    if server_handle.is_finished() {
+        return Err(eyre::eyre!(
+            "Signer service failed to start: {}",
+            server_handle.await.unwrap_err()
+        ));
+    }
+    Ok(start_config)
+}
+
+// Verifies that the pubkeys returned by the server match the pubkeys in the
+// test data
+pub async fn verify_pubkeys(response: Response) -> Result<()> {
+    // Verify the expected pubkeys are returned
+    assert!(response.status() == StatusCode::OK);
+    let pubkey_json = response.json::<GetPubkeysResponse>().await?;
+    assert_eq!(pubkey_json.keys.len(), 2);
+    let expected_pubkeys = vec![
+        FixedBytes::new(hex!("883827193f7627cd04e621e1e8d56498362a52b2a30c9a1c72036eb935c4278dee23d38a24d2f7dda62689886f0c39f4")),
+        FixedBytes::new(hex!("b3a22e4a673ac7a153ab5b3c17a4dbef55f7e47210b20c0cbb0e66df5b36bb49ef808577610b034172e955d2312a61b9")),
+    ];
+    for expected in expected_pubkeys {
+        assert!(
+            pubkey_json.keys.iter().any(|k| k.consensus == expected),
+            "Expected pubkey not found: {:?}",
+            expected
+        );
+        info!("Server returned expected pubkey: {:?}", expected);
+    }
+    Ok(())
+}
+
+// Creates a JWT for module administration
+pub fn create_admin_jwt(admin_secret: String) -> Result<Jwt> {
+    jsonwebtoken::encode(
+        &jsonwebtoken::Header::default(),
+        &JwtAdmin {
+            admin: true,
+            exp: jsonwebtoken::get_current_timestamp() + SIGNER_JWT_EXPIRATION,
+        },
+        &jsonwebtoken::EncodingKey::from_secret(admin_secret.as_ref()),
+    )
+    .map_err(Into::into)
+    .map(Jwt::from)
+}
diff --git a/tests/src/utils.rs b/tests/src/utils.rs
index 30835ebb..0493040c 100644
--- a/tests/src/utils.rs
+++ b/tests/src/utils.rs
@@ -4,12 +4,17 @@ use std::{
     sync::{Arc, Once},
 };
 
-use alloy::{primitives::U256, rpc::types::beacon::BlsPublicKey};
+use alloy::{
+    primitives::{B256, U256},
+    rpc::types::beacon::BlsPublicKey,
+};
 use cb_common::{
     config::{
-        PbsConfig, PbsModuleConfig, RelayConfig, SignerConfig, SignerType, StartSignerConfig,
-        SIGNER_IMAGE_DEFAULT, SIGNER_JWT_AUTH_FAIL_LIMIT_DEFAULT,
-        SIGNER_JWT_AUTH_FAIL_TIMEOUT_SECONDS_DEFAULT, SIGNER_PORT_DEFAULT,
+        CommitBoostConfig, LogsSettings, ModuleKind, ModuleSigningConfig, PbsConfig,
+        PbsModuleConfig, RelayConfig, SignerConfig, SignerType, StartSignerConfig,
+        StaticModuleConfig, StaticPbsConfig, SIGNER_IMAGE_DEFAULT,
+        SIGNER_JWT_AUTH_FAIL_LIMIT_DEFAULT, SIGNER_JWT_AUTH_FAIL_TIMEOUT_SECONDS_DEFAULT,
+        SIGNER_PORT_DEFAULT,
     },
     pbs::{RelayClient, RelayEntry},
     signer::SignerLoader,
@@ -65,7 +70,7 @@ pub fn generate_mock_relay_with_batch_size(
     RelayClient::new(config)
 }
 
-pub fn get_pbs_static_config(port: u16) -> PbsConfig {
+pub fn get_pbs_config(port: u16) -> PbsConfig {
     PbsConfig {
         host: Ipv4Addr::UNSPECIFIED,
         port,
@@ -84,6 +89,23 @@ pub fn get_pbs_static_config(port: u16) -> PbsConfig {
     }
 }
 
+pub fn get_pbs_static_config(pbs_config: PbsConfig) -> StaticPbsConfig {
+    StaticPbsConfig { docker_image: String::from(""), pbs_config, with_signer: true }
+}
+
+pub fn get_commit_boost_config(pbs_static_config: StaticPbsConfig) -> CommitBoostConfig {
+    CommitBoostConfig {
+        chain: Chain::Hoodi,
+        relays: vec![],
+        pbs: pbs_static_config,
+        muxes: None,
+        modules: Some(vec![]),
+        signer: None,
+        metrics: None,
+        logs: LogsSettings::default(),
+    }
+}
+
 pub fn to_pbs_config(
     chain: Chain,
     pbs_config: PbsConfig,
@@ -115,7 +137,7 @@ pub fn get_signer_config(loader: SignerLoader) -> SignerConfig {
 pub fn get_start_signer_config(
     signer_config: SignerConfig,
     chain: Chain,
-    jwts: HashMap<ModuleId, String>,
+    mod_signing_configs: &HashMap<ModuleId, ModuleSigningConfig>,
     admin_secret: String,
 ) -> StartSignerConfig {
     match signer_config.inner {
@@ -124,7 +146,7 @@ pub fn get_start_signer_config(
             loader: Some(loader),
             store: None,
             endpoint: SocketAddr::new(signer_config.host.into(), signer_config.port),
-            jwts,
+            mod_signing_configs: mod_signing_configs.clone(),
             admin_secret,
             jwt_auth_fail_limit: signer_config.jwt_auth_fail_limit,
             jwt_auth_fail_timeout_seconds: signer_config.jwt_auth_fail_timeout_seconds,
@@ -133,3 +155,14 @@ pub fn get_start_signer_config(
         _ => panic!("Only local signers are supported in tests"),
     }
 }
+
+pub fn create_module_config(id: ModuleId, signing_id: B256) -> StaticModuleConfig {
+    StaticModuleConfig {
+        id,
+        signing_id,
+        docker_image: String::from(""),
+        env: None,
+        env_file: None,
+        kind: ModuleKind::Commit,
+    }
+}
diff --git a/tests/tests/pbs_get_header.rs b/tests/tests/pbs_get_header.rs
index 10f30b6a..088fedb2 100644
--- a/tests/tests/pbs_get_header.rs
+++ b/tests/tests/pbs_get_header.rs
@@ -12,7 +12,7 @@ use cb_pbs::{DefaultBuilderApi, PbsService, PbsState};
 use cb_tests::{
     mock_relay::{start_mock_relay_service, MockRelayState},
     mock_validator::MockValidator,
-    utils::{generate_mock_relay, get_pbs_static_config, setup_test_env, to_pbs_config},
+    utils::{generate_mock_relay, get_pbs_config, setup_test_env, to_pbs_config},
 };
 use eyre::Result;
 use reqwest::StatusCode;
@@ -35,7 +35,7 @@ async fn test_get_header() -> Result<()> {
     tokio::spawn(start_mock_relay_service(mock_state.clone(), relay_port));
 
     // Run the PBS service
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), vec![mock_relay.clone()]);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), vec![mock_relay.clone()]);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
@@ -58,7 +58,7 @@ async fn test_get_header() -> Result<()> {
     assert_eq!(res.message.header.timestamp, timestamp_of_slot_start_sec(0, chain));
     assert_eq!(
         res.signature,
-        sign_builder_root(chain, &mock_state.signer, res.message.tree_hash_root().0)
+        sign_builder_root(chain, &mock_state.signer, &res.message.tree_hash_root())
     );
     Ok(())
 }
@@ -81,7 +81,7 @@ async fn test_get_header_returns_204_if_relay_down() -> Result<()> {
     // tokio::spawn(start_mock_relay_service(mock_state.clone(), relay_port));
 
     // Run the PBS service
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), vec![mock_relay.clone()]);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), vec![mock_relay.clone()]);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
@@ -113,7 +113,7 @@ async fn test_get_header_returns_400_if_request_is_invalid() -> Result<()> {
     tokio::spawn(start_mock_relay_service(mock_state.clone(), relay_port));
 
     // Run the PBS service
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), vec![mock_relay.clone()]);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), vec![mock_relay.clone()]);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
diff --git a/tests/tests/pbs_get_status.rs b/tests/tests/pbs_get_status.rs
index 3e913dc5..629bea69 100644
--- a/tests/tests/pbs_get_status.rs
+++ b/tests/tests/pbs_get_status.rs
@@ -9,7 +9,7 @@ use cb_pbs::{DefaultBuilderApi, PbsService, PbsState};
 use cb_tests::{
     mock_relay::{start_mock_relay_service, MockRelayState},
     mock_validator::MockValidator,
-    utils::{generate_mock_relay, get_pbs_static_config, setup_test_env, to_pbs_config},
+    utils::{generate_mock_relay, get_pbs_config, setup_test_env, to_pbs_config},
 };
 use eyre::Result;
 use reqwest::StatusCode;
@@ -34,7 +34,7 @@ async fn test_get_status() -> Result<()> {
     tokio::spawn(start_mock_relay_service(mock_state.clone(), relay_0_port));
     tokio::spawn(start_mock_relay_service(mock_state.clone(), relay_1_port));
 
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays.clone());
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), relays.clone());
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
@@ -67,7 +67,7 @@ async fn test_get_status_returns_502_if_relay_down() -> Result<()> {
     // Don't start the relay
     // tokio::spawn(start_mock_relay_service(mock_state.clone(), relay_port));
 
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays.clone());
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), relays.clone());
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
diff --git a/tests/tests/pbs_mux.rs b/tests/tests/pbs_mux.rs
index 4d830e20..84fa1a3d 100644
--- a/tests/tests/pbs_mux.rs
+++ b/tests/tests/pbs_mux.rs
@@ -10,7 +10,7 @@ use cb_pbs::{DefaultBuilderApi, PbsService, PbsState};
 use cb_tests::{
     mock_relay::{start_mock_relay_service, MockRelayState},
     mock_validator::MockValidator,
-    utils::{generate_mock_relay, get_pbs_static_config, setup_test_env, to_pbs_config},
+    utils::{generate_mock_relay, get_pbs_config, setup_test_env, to_pbs_config},
 };
 use eyre::Result;
 use reqwest::StatusCode;
@@ -37,7 +37,7 @@ async fn test_mux() -> Result<()> {
 
     // Register all relays in PBS config
     let relays = vec![default_relay.clone()];
-    let mut config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays);
+    let mut config = to_pbs_config(chain, get_pbs_config(pbs_port), relays);
     config.all_relays = vec![mux_relay_1.clone(), mux_relay_2.clone(), default_relay.clone()];
 
     // Configure mux for two relays
diff --git a/tests/tests/pbs_post_blinded_blocks.rs b/tests/tests/pbs_post_blinded_blocks.rs
index 9e91dfa9..24b7e66b 100644
--- a/tests/tests/pbs_post_blinded_blocks.rs
+++ b/tests/tests/pbs_post_blinded_blocks.rs
@@ -10,7 +10,7 @@ use cb_pbs::{DefaultBuilderApi, PbsService, PbsState};
 use cb_tests::{
     mock_relay::{start_mock_relay_service, MockRelayState},
     mock_validator::MockValidator,
-    utils::{generate_mock_relay, get_pbs_static_config, setup_test_env, to_pbs_config},
+    utils::{generate_mock_relay, get_pbs_config, setup_test_env, to_pbs_config},
 };
 use eyre::Result;
 use reqwest::{Response, StatusCode};
@@ -47,7 +47,7 @@ async fn test_submit_block_too_large() -> Result<()> {
     let mock_state = Arc::new(MockRelayState::new(chain, signer).with_large_body());
     tokio::spawn(start_mock_relay_service(mock_state.clone(), pbs_port + 1));
 
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), relays);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
@@ -77,7 +77,7 @@ async fn submit_block_impl(pbs_port: u16, api_version: &BuilderApiVersion) -> Re
     tokio::spawn(start_mock_relay_service(mock_state.clone(), pbs_port + 1));
 
     // Run the PBS service
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), relays);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
diff --git a/tests/tests/pbs_post_validators.rs b/tests/tests/pbs_post_validators.rs
index f2480ac1..1ab3a786 100644
--- a/tests/tests/pbs_post_validators.rs
+++ b/tests/tests/pbs_post_validators.rs
@@ -10,7 +10,7 @@ use cb_pbs::{DefaultBuilderApi, PbsService, PbsState};
 use cb_tests::{
     mock_relay::{start_mock_relay_service, MockRelayState},
     mock_validator::MockValidator,
-    utils::{generate_mock_relay, get_pbs_static_config, setup_test_env, to_pbs_config},
+    utils::{generate_mock_relay, get_pbs_config, setup_test_env, to_pbs_config},
 };
 use eyre::Result;
 use reqwest::StatusCode;
@@ -31,7 +31,7 @@ async fn test_register_validators() -> Result<()> {
     tokio::spawn(start_mock_relay_service(mock_state.clone(), pbs_port + 1));
 
     // Run the PBS service
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), relays);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
@@ -77,7 +77,7 @@ async fn test_register_validators_returns_422_if_request_is_malformed() -> Resul
     tokio::spawn(start_mock_relay_service(mock_state.clone(), pbs_port + 1));
 
     // Run the PBS service
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), relays);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
 
@@ -220,7 +220,7 @@ async fn test_register_validators_does_not_retry_on_429() -> Result<()> {
     tokio::spawn(start_mock_relay_service(mock_state.clone(), pbs_port + 1));
 
     // Run the PBS service
-    let config = to_pbs_config(chain, get_pbs_static_config(pbs_port), relays);
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), relays);
     let state = PbsState::new(config);
     tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state.clone()));
 
@@ -272,7 +272,7 @@ async fn test_register_validators_retries_on_500() -> Result<()> {
     tokio::spawn(start_mock_relay_service(mock_state.clone(), pbs_port + 1));
 
     // Set retry limit to 3
-    let mut pbs_config = get_pbs_static_config(pbs_port);
+    let mut pbs_config = get_pbs_config(pbs_port);
     pbs_config.register_validator_retry_limit = 3;
 
     let config = to_pbs_config(chain, pbs_config, relays);
diff --git a/tests/tests/signer_jwt_auth.rs b/tests/tests/signer_jwt_auth.rs
index 820afbcc..63f0783f 100644
--- a/tests/tests/signer_jwt_auth.rs
+++ b/tests/tests/signer_jwt_auth.rs
@@ -1,35 +1,48 @@
 use std::{collections::HashMap, time::Duration};
 
-use alloy::{hex, primitives::FixedBytes};
+use alloy::primitives::b256;
 use cb_common::{
-    commit::{
-        constants::{GET_PUBKEYS_PATH, REVOKE_MODULE_PATH},
-        request::GetPubkeysResponse,
-    },
-    config::StartSignerConfig,
-    constants::SIGNER_JWT_EXPIRATION,
-    signer::{SignerLoader, ValidatorKeysFormat},
-    types::{Chain, Jwt, JwtAdmin, ModuleId},
+    commit::constants::{GET_PUBKEYS_PATH, REVOKE_MODULE_PATH},
+    config::{load_module_signing_configs, ModuleSigningConfig},
+    types::ModuleId,
     utils::create_jwt,
 };
-use cb_signer::service::SigningService;
-use cb_tests::utils::{get_signer_config, get_start_signer_config, setup_test_env};
+use cb_tests::{
+    signer_service::{create_admin_jwt, start_server, verify_pubkeys},
+    utils::{self, setup_test_env},
+};
 use eyre::Result;
-use reqwest::{Response, StatusCode};
+use reqwest::StatusCode;
 use tracing::info;
 
 const JWT_MODULE: &str = "test-module";
 const JWT_SECRET: &str = "test-jwt-secret";
 const ADMIN_SECRET: &str = "test-admin-secret";
 
+async fn create_mod_signing_configs() -> HashMap<ModuleId, ModuleSigningConfig> {
+    let mut cfg =
+        utils::get_commit_boost_config(utils::get_pbs_static_config(utils::get_pbs_config(0)));
+
+    let module_id = ModuleId(JWT_MODULE.to_string());
+    let signing_id = b256!("0101010101010101010101010101010101010101010101010101010101010101");
+
+    cfg.modules = Some(vec![utils::create_module_config(module_id.clone(), signing_id)]);
+
+    let jwts = HashMap::from([(module_id.clone(), JWT_SECRET.to_string())]);
+
+    load_module_signing_configs(&cfg, &jwts).unwrap()
+}
+
 #[tokio::test]
 async fn test_signer_jwt_auth_success() -> Result<()> {
     setup_test_env();
     let module_id = ModuleId(JWT_MODULE.to_string());
-    let start_config = start_server(20100).await?;
+    let mod_cfgs = create_mod_signing_configs().await;
+    let start_config = start_server(20100, &mod_cfgs, ADMIN_SECRET.to_string()).await?;
+    let jwt_config = mod_cfgs.get(&module_id).expect("JWT config for test module not found");
 
     // Run a pubkeys request
-    let jwt = create_jwt(&module_id, JWT_SECRET)?;
+    let jwt = create_jwt(&module_id, &jwt_config.jwt_secret)?;
     let client = reqwest::Client::new();
     let url = format!("http://{}{}", start_config.endpoint, GET_PUBKEYS_PATH);
     let response = client.get(&url).bearer_auth(&jwt).send().await?;
@@ -44,7 +57,8 @@ async fn test_signer_jwt_auth_success() -> Result<()> {
 async fn test_signer_jwt_auth_fail() -> Result<()> {
     setup_test_env();
     let module_id = ModuleId(JWT_MODULE.to_string());
-    let start_config = start_server(20200).await?;
+    let mod_cfgs = create_mod_signing_configs().await;
+    let start_config = start_server(20101, &mod_cfgs, ADMIN_SECRET.to_string()).await?;
 
     // Run a pubkeys request - this should fail due to invalid JWT
     let jwt = create_jwt(&module_id, "incorrect secret")?;
@@ -64,7 +78,9 @@ async fn test_signer_jwt_auth_fail() -> Result<()> {
 async fn test_signer_jwt_rate_limit() -> Result<()> {
     setup_test_env();
     let module_id = ModuleId(JWT_MODULE.to_string());
-    let start_config = start_server(20300).await?;
+    let mod_cfgs = create_mod_signing_configs().await;
+    let start_config = start_server(20102, &mod_cfgs, ADMIN_SECRET.to_string()).await?;
+    let mod_cfg = mod_cfgs.get(&module_id).expect("JWT config for test module not found");
 
     // Run as many pubkeys requests as the fail limit
     let jwt = create_jwt(&module_id, "incorrect secret")?;
@@ -76,7 +92,7 @@ async fn test_signer_jwt_rate_limit() -> Result<()> {
     }
 
     // Run another request - this should fail due to rate limiting now
-    let jwt = create_jwt(&module_id, JWT_SECRET)?;
+    let jwt = create_jwt(&module_id, &mod_cfg.jwt_secret)?;
     let response = client.get(&url).bearer_auth(&jwt).send().await?;
     assert!(response.status() == StatusCode::TOO_MANY_REQUESTS);
 
@@ -94,12 +110,14 @@ async fn test_signer_jwt_rate_limit() -> Result<()> {
 #[tokio::test]
 async fn test_signer_revoked_jwt_fail() -> Result<()> {
     setup_test_env();
+    let admin_secret = ADMIN_SECRET.to_string();
     let module_id = ModuleId(JWT_MODULE.to_string());
-    let start_config = start_server(20400).await?;
+    let mod_cfgs = create_mod_signing_configs().await;
+    let start_config = start_server(20400, &mod_cfgs, admin_secret.clone()).await?;
 
     // Run as many pubkeys requests as the fail limit
     let jwt = create_jwt(&module_id, JWT_SECRET)?;
-    let admin_jwt = create_admin_jwt()?;
+    let admin_jwt = create_admin_jwt(admin_secret)?;
     let client = reqwest::Client::new();
 
     // At first, test module should be allowed to request pubkeys
@@ -127,12 +145,14 @@ async fn test_signer_revoked_jwt_fail() -> Result<()> {
 #[tokio::test]
 async fn test_signer_only_admin_can_revoke() -> Result<()> {
     setup_test_env();
+    let admin_secret = ADMIN_SECRET.to_string();
     let module_id = ModuleId(JWT_MODULE.to_string());
-    let start_config = start_server(20500).await?;
+    let mod_cfgs = create_mod_signing_configs().await;
+    let start_config = start_server(20500, &mod_cfgs, admin_secret.clone()).await?;
 
     // Run as many pubkeys requests as the fail limit
     let jwt = create_jwt(&module_id, JWT_SECRET)?;
-    let admin_jwt = create_admin_jwt()?;
+    let admin_jwt = create_admin_jwt(admin_secret)?;
     let client = reqwest::Client::new();
     let url = format!("http://{}{}", start_config.endpoint, REVOKE_MODULE_PATH);
 
@@ -158,75 +178,3 @@ async fn test_signer_only_admin_can_revoke() -> Result<()> {
 
     Ok(())
 }
-
-// Starts the signer moduler server on a separate task and returns its
-// configuration
-async fn start_server(port: u16) -> Result<StartSignerConfig> {
-    setup_test_env();
-    let chain = Chain::Hoodi;
-
-    // Mock JWT secrets
-    let module_id = ModuleId(JWT_MODULE.to_string());
-    let mut jwts = HashMap::new();
-    jwts.insert(module_id.clone(), JWT_SECRET.to_string());
-
-    // Create a signer config
-    let loader = SignerLoader::ValidatorsDir {
-        keys_path: "data/keystores/keys".into(),
-        secrets_path: "data/keystores/secrets".into(),
-        format: ValidatorKeysFormat::Lighthouse,
-    };
-    let mut config = get_signer_config(loader);
-    config.port = port;
-    config.jwt_auth_fail_limit = 3; // Set a low fail limit for testing
-    config.jwt_auth_fail_timeout_seconds = 3; // Set a short timeout for testing
-    let start_config = get_start_signer_config(config, chain, jwts, ADMIN_SECRET.to_string());
-
-    // Run the Signer
-    let server_handle = tokio::spawn(SigningService::run(start_config.clone()));
-
-    // Make sure the server is running
-    tokio::time::sleep(Duration::from_millis(100)).await;
-    if server_handle.is_finished() {
-        return Err(eyre::eyre!(
-            "Signer service failed to start: {}",
-            server_handle.await.unwrap_err()
-        ));
-    }
-    Ok(start_config)
-}
-
-// Verifies that the pubkeys returned by the server match the pubkeys in the
-// test data
-async fn verify_pubkeys(response: Response) -> Result<()> {
-    // Verify the expected pubkeys are returned
-    assert!(response.status() == StatusCode::OK);
-    let pubkey_json = response.json::<GetPubkeysResponse>().await?;
-    assert_eq!(pubkey_json.keys.len(), 2);
-    let expected_pubkeys = vec![
-        FixedBytes::new(hex!("883827193f7627cd04e621e1e8d56498362a52b2a30c9a1c72036eb935c4278dee23d38a24d2f7dda62689886f0c39f4")),
-        FixedBytes::new(hex!("b3a22e4a673ac7a153ab5b3c17a4dbef55f7e47210b20c0cbb0e66df5b36bb49ef808577610b034172e955d2312a61b9")),
-    ];
-    for expected in expected_pubkeys {
-        assert!(
-            pubkey_json.keys.iter().any(|k| k.consensus == expected),
-            "Expected pubkey not found: {:?}",
-            expected
-        );
-        info!("Server returned expected pubkey: {:?}", expected);
-    }
-    Ok(())
-}
-
-fn create_admin_jwt() -> Result<Jwt> {
-    jsonwebtoken::encode(
-        &jsonwebtoken::Header::default(),
-        &JwtAdmin {
-            admin: true,
-            exp: jsonwebtoken::get_current_timestamp() + SIGNER_JWT_EXPIRATION,
-        },
-        &jsonwebtoken::EncodingKey::from_secret(ADMIN_SECRET.as_ref()),
-    )
-    .map_err(Into::into)
-    .map(Jwt::from)
-}
diff --git a/tests/tests/signer_request_sig.rs b/tests/tests/signer_request_sig.rs
new file mode 100644
index 00000000..868a1f71
--- /dev/null
+++ b/tests/tests/signer_request_sig.rs
@@ -0,0 +1,113 @@
+use std::collections::HashMap;
+
+use alloy::{
+    hex,
+    primitives::{b256, FixedBytes},
+};
+use cb_common::{
+    commit::{
+        constants::REQUEST_SIGNATURE_PATH,
+        request::{SignConsensusRequest, SignRequest},
+    },
+    config::{load_module_signing_configs, ModuleSigningConfig},
+    types::ModuleId,
+    utils::create_jwt,
+};
+use cb_tests::{
+    signer_service::start_server,
+    utils::{self, setup_test_env},
+};
+use eyre::Result;
+use reqwest::StatusCode;
+
+const MODULE_ID_1: &str = "test-module";
+const MODULE_ID_2: &str = "another-module";
+const PUBKEY_1: [u8; 48] =
+    hex!("883827193f7627cd04e621e1e8d56498362a52b2a30c9a1c72036eb935c4278dee23d38a24d2f7dda62689886f0c39f4");
+const ADMIN_SECRET: &str = "test-admin-secret";
+
+async fn create_mod_signing_configs() -> HashMap<ModuleId, ModuleSigningConfig> {
+    let mut cfg =
+        utils::get_commit_boost_config(utils::get_pbs_static_config(utils::get_pbs_config(0)));
+
+    let module_id_1 = ModuleId(MODULE_ID_1.to_string());
+    let signing_id_1 = b256!("0x6a33a23ef26a4836979edff86c493a69b26ccf0b4a16491a815a13787657431b");
+    let module_id_2 = ModuleId(MODULE_ID_2.to_string());
+    let signing_id_2 = b256!("0x61fe00135d7b4912a8c63ada215ac2e62326e6e7b30f49a29fcf9779d7ad800d");
+
+    cfg.modules = Some(vec![
+        utils::create_module_config(module_id_1.clone(), signing_id_1),
+        utils::create_module_config(module_id_2.clone(), signing_id_2),
+    ]);
+
+    let jwts = HashMap::from([
+        (module_id_1.clone(), "supersecret".to_string()),
+        (module_id_2.clone(), "anothersecret".to_string()),
+    ]);
+
+    load_module_signing_configs(&cfg, &jwts).unwrap()
+}
+
+/// Makes sure the signer service signs requests correctly, using the module's
+/// signing ID
+#[tokio::test]
+async fn test_signer_sign_request_good() -> Result<()> {
+    setup_test_env();
+    let module_id = ModuleId(MODULE_ID_1.to_string());
+    let mod_cfgs = create_mod_signing_configs().await;
+    let start_config = start_server(20200, &mod_cfgs, ADMIN_SECRET.to_string()).await?;
+    let jwt_config = mod_cfgs.get(&module_id).expect("JWT config for test module not found");
+
+    // Send a signing request
+    let object_root = b256!("0x0123456789012345678901234567890123456789012345678901234567890123");
+    let request =
+        SignRequest::Consensus(SignConsensusRequest { pubkey: FixedBytes(PUBKEY_1), object_root });
+    let jwt = create_jwt(&module_id, &jwt_config.jwt_secret)?;
+    let client = reqwest::Client::new();
+    let url = format!("http://{}{}", start_config.endpoint, REQUEST_SIGNATURE_PATH);
+    let response = client.post(&url).json(&request).bearer_auth(&jwt).send().await?;
+
+    // Verify the response is successful
+    assert!(response.status() == StatusCode::OK);
+
+    // Verify the signature is returned
+    let signature = response.text().await?;
+    assert!(!signature.is_empty(), "Signature should not be empty");
+
+    let expected_signature = "\"0xa43e623f009e615faa3987368f64d6286a4103de70e9a81d82562c50c91eae2d5d6fb9db9fe943aa8ee42fd92d8210c1149f25ed6aa72a557d74a0ed5646fdd0e8255ec58e3e2931695fe913863ba0cdf90d29f651bce0a34169a6f6ce5b3115\"";
+    assert_eq!(signature, expected_signature, "Signature does not match expected value");
+
+    Ok(())
+}
+
+/// Makes sure the signer service returns a signature that is different for each
+/// module
+#[tokio::test]
+async fn test_signer_sign_request_different_module() -> Result<()> {
+    setup_test_env();
+    let module_id = ModuleId(MODULE_ID_2.to_string());
+    let mod_cfgs = create_mod_signing_configs().await;
+    let start_config = start_server(20201, &mod_cfgs, ADMIN_SECRET.to_string()).await?;
+    let jwt_config = mod_cfgs.get(&module_id).expect("JWT config for 2nd test module not found");
+
+    // Send a signing request
+    let object_root = b256!("0x0123456789012345678901234567890123456789012345678901234567890123");
+    let request =
+        SignRequest::Consensus(SignConsensusRequest { pubkey: FixedBytes(PUBKEY_1), object_root });
+    let jwt = create_jwt(&module_id, &jwt_config.jwt_secret)?;
+    let client = reqwest::Client::new();
+    let url = format!("http://{}{}", start_config.endpoint, REQUEST_SIGNATURE_PATH);
+    let response = client.post(&url).json(&request).bearer_auth(&jwt).send().await?;
+
+    // Verify the response is successful
+    assert!(response.status() == StatusCode::OK);
+
+    // Verify the signature is returned
+    let signature = response.text().await?;
+    assert!(!signature.is_empty(), "Signature should not be empty");
+
+    let incorrect_signature = "\"0xa43e623f009e615faa3987368f64d6286a4103de70e9a81d82562c50c91eae2d5d6fb9db9fe943aa8ee42fd92d8210c1149f25ed6aa72a557d74a0ed5646fdd0e8255ec58e3e2931695fe913863ba0cdf90d29f651bce0a34169a6f6ce5b3115\"";
+    assert_ne!(signature, incorrect_signature, "Signature does not match expected value");
+
+    Ok(())
+}