Name snapshots by full date instead of just year

Snapshots are now written as <KEYID>-public_YYYY-MM-DD.asc,
one file per ceremony, matching the naming of the secret exports
kept outside this repository

OPENPGP.md

@@ -71,9 +71,8 @@ gpg --verify OPENPGP.md.asc OPENPGP.md
     such as the 2026 supersession and the `age` key introduction
   - `history/`, armored exports of all retired keys,
     see [Key History](#key-history) below
-  - `snapshots/<KEYID>-public-YYYY.asc`,
+  - `snapshots/<KEYID>-public_YYYY-MM-DD.asc`,
-    refreshed at every ceremony,
+    one file per ceremony,
-    one file per year,
     written by `scripts/snapshot.sh`
   - One commit per ceremony to keep
     snapshot, updated tables,

OPENPGP.md.asc

@@ -1,7 +1,7 @@
 -----BEGIN PGP SIGNATURE-----
 
-iHUEABYKAB0WIQTW0Zid8fayP9d2KT20bttN/CaAXQUCarGDIgAKCRC0bttN/CaA
+iHUEABYKAB0WIQTW0Zid8fayP9d2KT20bttN/CaAXQUCarGDOQAKCRC0bttN/CaA
-XYaFAP92QJ2JOCVI5L0SgWwnE2p9wbr19jmwa4bLpe8jjDWM1AD+KmUPYusOcWu0
+XbcdAQDDF3oKFFZQCw9dVLkf6ooaiS601qRyHHVGNPOkjfhmcwD/di5Wi6uTR3r+
-BtCjSOPVI5P0S390W67K12LOzI/vOAY=
+pqReqX1gST9JsNyGmL4pTti+ItwY3gk=
-=q3oD
+=p0SW
 -----END PGP SIGNATURE-----

README.md

@@ -93,7 +93,7 @@ How I implement [OpenPGP](https://www.openpgp.org/):
 - [`security.txt`](security.txt): [RFC 9116](https://www.rfc-editor.org/info/rfc9116/)
   contact file, clearsigned, renewed at every ceremony
 - [`snapshots/`](snapshots/):
-  Yearly exports of the current OpenPGP key
+  Dated exports of the current OpenPGP key, one per ceremony
 - [`ceremonies/`](ceremonies/):
   Signed records of exceptional events
 - [`history/`](history/):

scripts/snapshot.sh

@@ -1,12 +1,12 @@
 #!/bin/sh
 
-# Export the current OpenPGP public key as a yearly snapshot
+# Export the current OpenPGP public key as a dated snapshot
 #
-# Usage:  ./scripts/snapshot.sh [YEAR]
+# Usage:  ./scripts/snapshot.sh [DATE]
 #
-# YEAR defaults to the current UTC year
+# DATE defaults to the current UTC date (YYYY-MM-DD)
 #
-# Writes snapshots/<KEYID>-public-<YEAR>.asc and refreshes public-key.asc
+# Writes snapshots/<KEYID>-public_<DATE>.asc and refreshes public-key.asc
 
 set -eu
 
@@ -16,7 +16,7 @@ SIGNING_KEY='D6D1989DF1F6B23FD776293DB46EDB4DFC26805D'
 
 
 REPO=$(cd "$(dirname "$0")/.." && pwd)
-YEAR=${1:-$(date -u +%Y)}
+DATE=${1:-$(date -u +%F)}
 
 # Notes:
 #  - the first "fpr" line is the primary key's fingerprint
@@ -30,7 +30,7 @@ fi
 # The last 16 hex chars, as used in OPENPGP.md
 KEYID=${FPR#"${FPR%????????????????}"}
 
-OUT="$REPO/snapshots/$KEYID-public-$YEAR.asc"
+OUT="$REPO/snapshots/${KEYID}-public_$DATE.asc"
 
 
 mkdir -p "$REPO/snapshots"
@@ -69,4 +69,4 @@ cp "$OUT" "$REPO/public-key.asc"
 gpg --show-keys "$OUT" >&2
 
 
-echo "Wrote snapshots/$KEYID-public-$YEAR.asc and public-key.asc"
+echo "Wrote snapshots/${KEYID}-public_$DATE.asc and public-key.asc"