Add age key

- Add AGE.md with policies
- Add age-recipient.txt for `age -R`
- Add ceremonies/2026-09-13_age_key.md as the signed record
  of which recipient is valid from which date
- List the recipient in KEYS.md
- Describe AGE.md and age-recipient.txt in README.md
- Extend the scripts:
  + sign.sh signs AGE.md by default
  + verify.sh verifies AGE.md by default
    and cross-checks age-recipient.txt,
    the only unsigned artifact,
    against the recipient in the signed KEYS.md and AGE.md

scripts/sign.sh

@@ -4,7 +4,7 @@
 #
 # Usage:  ./scripts/sign.sh [FILE...]
 #
-# FILE defaults to KEYS.md OPENPGP.md
+# FILE defaults to KEYS.md OPENPGP.md AGE.md
 #
 # Writes FILE.asc next to each FILE and verifies it
 
@@ -22,6 +22,7 @@ if [ $# -eq 0 ]; then
     set -- \
         "$REPO/KEYS.md" \
         "$REPO/OPENPGP.md" \
+        "$REPO/AGE.md" \
         # Keep this list aligned with the documentation at the top
 fi
 

scripts/verify.sh

@@ -4,15 +4,17 @@
 #
 # Usage:  ./scripts/verify.sh [FILE...]
 #
-# FILE defaults to KEYS.md OPENPGP.md ceremonies/*.md
+# FILE defaults to KEYS.md OPENPGP.md ceremonies/*.md AGE.md
 #
 # A FILE with a FILE.asc next to it is checked as a detached signature,
 # any other FILE as a clearsigned document
 #
-# Also checks the key's expiry
+# Also checks the key's expiry, and,
+# if KEYS.md or AGE.md is among the FILEs,
+# that age-recipient.txt matches the recipient in them
 #
 # Exits non-zero if any file lacks a valid signature from the pinned key,
-# or if the key has expired
+# or if the key has expired, or if a cross-check fails
 
 set -eu
 
@@ -33,6 +35,7 @@ if [ $# -eq 0 ]; then
         "$REPO/KEYS.md" \
         "$REPO/OPENPGP.md" \
         "$REPO"/ceremonies/*.md \
+        "$REPO/AGE.md" \
         # Keep this list aligned with the documentation at the top
 fi
 
@@ -100,4 +103,26 @@ else
 fi
 
 
+# age-recipient.txt is the only unsigned artifact,
+# so it must match the recipient in the signed documents
+for FILE; do
+
+    case "$FILE" in
+        */KEYS.md | KEYS.md | */AGE.md | AGE.md)
+            # shellcheck disable=SC2016  # The backticks are literal Markdown
+            EXPECTED=$(sed -n 's/^> `\(age1[0-9a-z]*\)`$/\1/p' "$FILE")
+            ACTUAL=$(cat "$REPO/age-recipient.txt")
+            if [ -z "$EXPECTED" ]; then
+                echo "FAIL  No age recipient found in $FILE" >&2
+                FAILED=1
+            elif [ "$ACTUAL" != "$EXPECTED" ]; then
+                echo "FAIL  age-recipient.txt has $ACTUAL, $FILE has $EXPECTED" >&2
+                FAILED=1
+            fi
+            ;;
+    esac
+
+done
+
+
 exit "$FAILED"