Add age key

- Add AGE.md with policies
- Add age-recipient.txt for `age -R`
- Add ceremonies/2026-09-13_age_key.md as the signed record
  of which recipient is valid from which date
- List the recipient in KEYS.md
- Describe AGE.md and age-recipient.txt in README.md
- Extend the scripts:
  + sign.sh signs AGE.md by default
  + verify.sh verifies AGE.md by default
    and cross-checks age-recipient.txt,
    the only unsigned artifact,
    against the recipient in the signed KEYS.md and AGE.md

AGE.md

@@ -0,0 +1,61 @@
+# `age` Key Documentation
+
+This document specifies how I maintain my [age](https://github.com/FiloSottile/age) key.
+
+It is (re-)signed with the current OpenPGP key:
+
+```bash
+./scripts/sign.sh AGE.md  # to produce AGE.md.asc
+
+gpg --verify AGE.md.asc AGE.md
+```
+
+
+## Current Key
+
+> `age1gzy6tj8y93ljuelcedrkcsv3p6gygk7ng3386u32av9a4ujh737qef8crp`
+
+| Field    | Value                                      |
+|----------|--------------------------------------------|
+| Type     | X25519 (native age identity)               |
+| Created  | 2026-09-11                                 |
+| Expires  | never (because `age` has no expiry)        |
+| Deployed | all machines, `~/.config/age/identity.txt` |
+
+
+### Policies
+
+- One identity on all machines,
+  like the OpenPGP `[E]` subkey
+- No expiry and no revocation:
+  Rotation means replacing the key
+  in this file, in [`KEYS.md`](KEYS.md), and in [`age-recipient.txt`](age-recipient.txt),
+  recording it in [`ceremonies/`](ceremonies/),
+  running `./scripts/sign.sh` to re-sign the signed documents, and
+  encrypting anything that matters again
+- The OpenPGP signature on this file is the trust anchor;
+  [`age-recipient.txt`](age-recipient.txt) is a convenience copy for `age -R`
+
+
+### Storage
+
+- Secret key: In my **Vaultwarden** as secure note "age Identity"
+  (because they are offline-synced text, unlike attachments)
+- Public record: **This repository**
+  - [`AGE.md`](AGE.md)
+  - [`age-recipient.txt`](age-recipient.txt)
+- Distribution: My **public websites**
+  - [alexander-hess.com](https://www.alexander-hess.com/age-recipient.txt)
+    ([Policies](https://www.alexander-hess.com/AGE.md),
+     [Signature](https://www.alexander-hess.com/AGE.md.asc))
+  - [webartifex.de](https://www.webartifex.de/age-recipient.txt)
+    ([Policies](https://www.webartifex.de/AGE.md),
+     [Signature](https://www.webartifex.de/AGE.md.asc))
+
+
+## Ceremonies
+
+- Introduction of this key:
+  [`ceremonies/2026-09-13_age_key.md`](ceremonies/2026-09-13_age_key.md)
+- A future rotation gets its own record in [`ceremonies/`](ceremonies/),
+  signed with the OpenPGP key of that day