Initial commit

- add generic README.md
- add outline on how we structure the keys in KEYS.md

KEYS.md

@@ -0,0 +1,100 @@
+# OpenPGP Key Documentation & Ceremonies
+
+This document specifies how the PGP keys are maintained
+    for Alexander Hess (i.e., "me" in the following).
+It is re-signed at every ceremony, like so:
+
+```bash
+gpg --detach-sign --armor KEYS.md  # to produce KEYS.md.asc
+
+gpg --verify KEYS.md.asc KEYS.md
+```
+
+
+## Current Key
+
+> PLACEHOLDER
+
+
+| Field       | Value                                                 |
+|-------------|-------------------------------------------------------|
+| Fingerprint | `XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX`  |
+| Key ID      | `XXXXXXXXXXXXXXXX` (fingerprint's last 16 chars)      |
+| Primary     | ed25519 `[C]` OFFLINE (i.e., `sec#` on all machines)  |
+| Subkey 1    | cv25519 `[E]`                                         |
+| Subkey 2    | ed25519 `[S]` internal                                |
+| Created     | 2026-MM-DD                                            |
+| Expires     | always **End of January** (next: 2027-MM-DD)          |
+| Primary UID | `Alexander Hess <ah@alexander-hess.com>`              |
+| Other UID 1 | `Alexander Hess <alexander@webartifex.biz>`           |
+| Other UID 2 | `Alexander Hess <alexander@webartifex.de>`            |
+
+
+### Subkeys
+
+| Key ID             | Type | Purpose                    | Expires    |
+|--------------------|------|----------------------------|------------|
+| `XXXXXXXXXXXXXXXX` | E    | encryption                 | 2027-01-31 |
+| `XXXXXXXXXXXXXXXX` | S    | signing on my own machines | 2027-01-31 |
+
+
+### Policies
+
+- All parts (primary and every subkey) expire at the **end of January**
+  so the update ceremony in **early January** has a brief grace period
+- No `[A]` subkey: SSH stays separate in `~/.ssh`
+  because I prefer defaults over cleverness
+- Internal `[S]` subkey pinned everywhere with bang syntax (`<FPR>!`)
+  because I never want to rely on GPG's newest-subkey auto-selection
+- External `[S]` subkeys per client engagement
+  with shorter 6-month expiry living on client machines
+
+
+### Storage
+
+- Secret material: **Vaultwarden** as secure notes
+  (because they are offline-synced text, unlike attachments):
+  - Armored export of the primary secret key
+  - Revocation certificate, generated at key creation
+- Public record: **this repo**:
+  - `KEYS.md` and detached signature `KEYS.md.asc`
+  - `snapshots/<KEYID>-public-YYYY.asc`, committed at every ceremony
+  - One commit per ceremony to keep
+    snapshot, changelog, and re-signed `KEYS.md` together
+- Distribution:
+  - WKD on all three UID domains
+  - public keyservers (see section below)
+  - public websites
+    because this repo is the archive and not the channel:
+    - [alexander-hess.com](https://www.alexander-hess.com/KEYS.md)
+      ([Signature](https://www.alexander-hess.com/KEYS.md.asc))
+    - [webartifex.biz](https://www.webartifex.biz/KEYS.md)
+      ([Signature](https://www.webartifex.biz/KEYS.md.asc))
+    - [webartifex.de](https://www.webartifex.de/KEYS.md)
+      ([Signature](https://www.webartifex.de/KEYS.md.asc))
+- Machines: subkeys only
+  via `gpg --export-secret-subkeys <FPR>!` => keyring shows `sec#`
+- Rationale: secrets and public record in independent systems;
+  so, either one alone suffices to recover or verify the other
+
+
+### Publication to Keyservers
+
+````bash
+FPR=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+for KS in \
+    hkps://keys.openpgp.org \
+    hkps://keyserver.ubuntu.com \
+    hkps://pgpkeys.eu \
+    hkps://pgp.mit.edu \
+    hkps://keyserver.escomposlinux.org; do
+  echo "=== $KS ==="
+  gpg --keyserver "$KS" --send-keys "$FPR"
+done
+````
+
+- `keys.openpgp.org` strips UIDs until each address is verified
+  => Click the links mailed to all addresses
+- *Hockeypuck* servers (the other four) are append-only: They merge and never delete
+  => Run after *every* change