Improve PSK Generation to Prevent Spoofed Nodes with Recompiled Codebases

Currently, the GeneratePSK function produces a deterministic pre-shared key (PSK) based on a combination of:

• Static entropy derived from a hardcoded value (hashed 1000 times),
• The hash of the codebase,
• The semantic version (major),
• And the network identifier.

const spbFounding = -((int64(133129) << 16) + 51200) // 1703

func generateAnchoredEntropy() []byte {
    spbFoundingStr := strconv.FormatInt(spbFounding, 10)
    input := []byte(spbFoundingStr)
    for i := 0; i < 1000; i++ {
        sum := sha256.Sum256(input)
        input = sum[:]
    }
    return input
}

func GeneratePSK(codebase FileSystem, v *semver.Version) (PSK, error) {
    ...
    entropy := generateAnchoredEntropy()
    seed := append([]byte(config.Config().Node.Network), codeHash...)
    seed = append(seed, []byte(strconv.Itoa(v.Major()))...)
    seed = append(seed, entropy...)
    return ConvertToSHA256(seed), nil
}

Problem: since all these inputs can be known or replicated by an attacker (open-source code, semantic version, predictable entropy), a malicious actor can:

• Recompile a modified version of the codebase,
• Generate the same PSK,
• And potentially impersonate a valid node in the network.

This defeats the goal of using PSK to restrict access to trusted nodes.

I'm looking for ideas or feedback on how to improve the PSK generation to:

1. Prevent unauthorized nodes with modified codebases from deriving the same PSK.
2. Possibly tie the PSK to a private key or signed metadata.
3. Maintain usability without adding a central authority if possible.

Please help! Any thoughts on using HMAC with a node’s private key, signed PSKs, or temporary salts would be appreciated. Thanks in advance!