Keys

Public record of the cryptographic keys of Alexander Hess (i.e., "me" in this repository): What they are, how they are handled, and how to verify them.

There are two audiences for this repository:

• I want a how-to: OPENPGP.md and AGE.md hold the policies and ceremonies, and the scripts/ run them.
• Readers want to confirm my keys and my identity: Everything needed for that is in the Verify section below.

Verify

The fingerprint of my current PGP key is in KEYS.md, which is signed.

Compare the fingerprint with at least one source outside this repository to confirm my identity:

• WKD, for example, via gpg --locate-keys ah@alexander-hess.com
• The keyservers listed in OPENPGP.md, for example, gpg --keyserver hkps://keys.openpgp.org --search-keys alexander@webartifex.de
• KEYS.md obtained from my websites:
  • alexander-hess.com
  • webartifex.de

Then:

gpg --import public-key.asc

gpg --verify KEYS.md.asc KEYS.md
gpg --verify OPENPGP.md.asc OPENPGP.md
gpg --verify AGE.md.asc AGE.md
gpg --verify security.txt

Each gpg --verify will print two things:

1. Good signature from "Alexander Hess <...>": The file is intact and was signed by this key.
2. WARNING: This key is not certified with a trusted signature!: Because gpg likely has no record that this key is mine.

So, a good signature plus a matching Primary key fingerprint line is the full result.

To silence the warning on your machine, tell gpg about your check:

gpg --lsign-key <FPR>  # after comparing the fingerprint yourself

If you trusted one of the two keys I retired in 2026, they certified the current one, and the supersession is recorded in ceremonies/:

gpg --import history/344EA5AB10D868E0-public.asc history/6D11C1E91D3B0265-public.asc
gpg --check-signatures 8B1140ADB5185334E9FA513B75681C8167312680
gpg --verify ceremonies/2026-07-08_supersession.md.asc ceremonies/2026-07-08_supersession.md

Contents

The files in this repository are described below.

OpenPGP

How I implement OpenPGP:

• KEYS.md: Current keys, signed
• KEYS.md.asc: Detached signature, renewed at every ceremony
• OPENPGP.md: OpenPGP policies, ceremonies, and history
• OPENPGP.md.asc: Detached signature, renewed at every ceremony
• public-key.asc: Armored export of the current OpenPGP key
• security.txt: RFC 9116 contact file, clearsigned, renewed at every ceremony
• snapshots/: Dated exports of the current OpenPGP key, one per ceremony
• ceremonies/: Signed records of exceptional events
• history/: Armored public keys of all previous OpenPGP keys

age

Besides OpenPGP, I also use the modern age encryption:

• AGE.md: age policies
• AGE.md.asc: Detached signature, renewed at every ceremony
• age-recipient.txt: age public key for age -R
• ceremonies/: Signed record of when a recipient became valid or rotated because age keys carry no metadata of their own

Scripts

sh scripts for my own use:

• bootstrap.sh: Imports and trusts all keys on a new machine, then verifies all files
• sign.sh: Renews the detached signatures
• verify.sh: Verifies all signed files against the pinned signing subkey, warns when the key is about to expire, and cross-checks age-recipient.txt and security.txt
• snapshot.sh: Exports the current key to snapshots/ and public-key.asc
• publish.sh: Pushes the current key to the keyservers
• security-txt.sh: Generates and clearsigns security.txt