Turn on doppelganger protection

Doppelganger protection stops your validator client from signing when your keys are already running elsewhere.

Add --enable-doppelganger to your validator client. It's off by default; turn it on unless you have a reason not to.

At startup, the validator client checks whether your keys were active on the network in the last few epochs. It logs:

INFO client: Running doppelganger check keyCount=…
INFO client: Doppelganger check done duration=… keyCount=…

If your keys were active, it refuses to start instead:

Duplicate instances exists in the network for validator keys: <PUBKEYS>

Keys you add while it runs sit out of duties for about three epochs while they're checked. If one turns out to be active elsewhere, that key stays excluded and the validator logs:

Doppelganger detected for reloaded key; key remains excluded from duties

Your other keys keep working.

Doppelganger protection is a last line of defense, not a permission to run two copies. It can't catch a copy that was offline during the check and comes online later.