alexander/keys
Watch
1
0
Fork
You've already forked keys
 0
Code Activity

Add a signing subkey for the leonardo project

Browse source 
The subkey 16D5D4DFC0C36022 lives only on the project's machines,
with its own passphrase, and expires together with the primary key
on 2027-01-31

- Add the subkey to the table in OPENPGP.md
- Replace the 6-month expiry policy for external subkeys: they now
  follow the yearly update and are revoked as "retired" at project end
- Export the updated public key and a dated snapshot
- Re-sign OPENPGP.md
This commit is contained in:
Alexander Hess 2026-09-21 21:10:23 +02:00
commit ed6a26b69e
Signed by: alexander
GPG key ID: B46EDB4DFC26805D
4 changed files with 98 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
OPENPGP.md
View file

@ -36,6 +36,7 @@ gpg --verify OPENPGP.md.asc OPENPGP.md
|--------------------|------|-----------------------------------------|------------|
| `253A7FFDDF34BE5E` | E | encryption | 2027-01-31 |
| `B46EDB4DFC26805D` | S | signing on my own machines | 2027-01-31 |
| `16D5D4DFC0C36022` | S | signing on client machines (`leonardo`) | 2027-01-31 |
### Policies
@ -46,8 +47,12 @@ gpg --verify OPENPGP.md.asc OPENPGP.md
because I prefer defaults over cleverness
- Internal `[S]` subkey pinned everywhere with bang syntax (`<S_SUBKEY_FPR>!`)
because I never want to rely on GPG's newest-subkey auto-selection
- External `[S]` subkeys per client engagement
with shorter 6-month expiry living on client machines
- External `[S]` subkeys per client project,
living only on that project's machines with their own passphrase:
- Expire with the primary key at the **end of January**
- Extended at the yearly update only while the project continues
- Revoked as "retired" when the project ends,
so that their past signatures stay valid
### Storage
@ -56,6 +61,7 @@ gpg --verify OPENPGP.md.asc OPENPGP.md
(because they are offline-synced text, unlike attachments):
- "Full Secret Key": Armored export of primary and subkeys
- "Deployed Secret Keys": Armored export of the subkeys only
- "Client Secret Subkey (<project_name>)": Armored export of the client subkey(s) only
- "Revocation Certificate", generated at key creation
- "Key Info": All key IDs and fingerprints, as a login entry
- Public record: **This repository**:
@ -162,7 +168,7 @@ gpg --homedir "$T" --edit-key <FPR>
expire # Primary => At the end of NEXT January
key 1
key 2
key ... # Any further internal subkeys; external ones keep their own 6-month expiry
key ... # Any further subkeys, including external ones of ongoing projects
expire # Selected subkeys => Same date
save