One keypair, one upgrade.
330 of the 657 upgradeable Solana programs LUSCA keeps have a single keypair as their upgrade authority. 327 have a program-derived address. 108 more are immutable. 765 programs in total.
How it is read: the upgrade authority stored from each program's on-chain account (read through
@helius) is checked against the ed25519 curve. A point on the curve is a keypair, so one private key can sign an upgrade. An address off the curve is program-derived: it has no private key and only the program that owns it can sign. No extra RPC call, no project labels.
Example: OKX DEX Router, proVF4pMXVaYqmy4NjniPh4pqKNfMmsihgd4wdkCX3u. Upgrade authority CjoV5B96reuCfPh2rRK11G1QptG97jZdyZArTn3EN1Mj, a single keypair.
A single keypair is a fact about custody, not a verdict. The control map states it for every kept program, next to its custody chain.