Add a signing subkey for the leonardo project

The subkey 16D5D4DFC0C36022 lives only on the project's machines,
with its own passphrase, and expires together with the primary key
on 2027-01-31

- Add the subkey to the table in OPENPGP.md
- Replace the 6-month expiry policy for external subkeys: they now
  follow the yearly update and are revoked as "retired" at project end
- Export the updated public key and a dated snapshot
- Re-sign OPENPGP.md

OPENPGP.md

@@ -36,6 +36,7 @@ gpg --verify OPENPGP.md.asc OPENPGP.md
 |--------------------|------|-----------------------------------------|------------|
 | `253A7FFDDF34BE5E` | E    | encryption                              | 2027-01-31 |
 | `B46EDB4DFC26805D` | S    | signing on my own machines              | 2027-01-31 |
+| `16D5D4DFC0C36022` | S    | signing on client machines (`leonardo`) | 2027-01-31 |
 
 
 ### Policies
@@ -46,8 +47,12 @@ gpg --verify OPENPGP.md.asc OPENPGP.md
   because I prefer defaults over cleverness
 - Internal `[S]` subkey pinned everywhere with bang syntax (`<S_SUBKEY_FPR>!`)
   because I never want to rely on GPG's newest-subkey auto-selection
-- External `[S]` subkeys per client engagement
+- External `[S]` subkeys per client project,
-  with shorter 6-month expiry living on client machines
+  living only on that project's machines with their own passphrase:
+  - Expire with the primary key at the **end of January**
+  - Extended at the yearly update only while the project continues
+  - Revoked as "retired" when the project ends,
+    so that their past signatures stay valid
 
 
 ### Storage
@@ -56,6 +61,7 @@ gpg --verify OPENPGP.md.asc OPENPGP.md
   (because they are offline-synced text, unlike attachments):
   - "Full Secret Key": Armored export of primary and subkeys
   - "Deployed Secret Keys": Armored export of the subkeys only
+  - "Client Secret Subkey (<project_name>)": Armored export of the client subkey(s) only
   - "Revocation Certificate", generated at key creation
   - "Key Info": All key IDs and fingerprints, as a login entry
 - Public record: **This repository**:
@@ -162,7 +168,7 @@ gpg --homedir "$T" --edit-key <FPR>
   expire       # Primary => At the end of NEXT January
   key 1
   key 2
-  key ...      # Any further internal subkeys; external ones keep their own 6-month expiry
+  key ...      # Any further subkeys, including external ones of ongoing projects
   expire       # Selected subkeys => Same date
   save
 

OPENPGP.md.asc

@@ -1,7 +1,7 @@
 -----BEGIN PGP SIGNATURE-----
 
-iHUEABYKAB0WIQTW0Zid8fayP9d2KT20bttN/CaAXQUCarGDOQAKCRC0bttN/CaA
+iHUEABYKAB0WIQTW0Zid8fayP9d2KT20bttN/CaAXQUCarGGKQAKCRC0bttN/CaA
-XbcdAQDDF3oKFFZQCw9dVLkf6ooaiS601qRyHHVGNPOkjfhmcwD/di5Wi6uTR3r+
+Xfk5AP4/Uau6RwXLRf8OV36gBIzFN9tT9u485SoquQGwg5kwbAD/STyXOD/DUdbw
-pqReqX1gST9JsNyGmL4pTti+ItwY3gk=
+hIxxRa9pToMwxmSRINDwEcGNEc3FQQc=
-=p0SW
+=HavR
 -----END PGP SIGNATURE-----

public-key.asc

@@ -66,6 +66,12 @@ XB7OiPUEGBYKACYWIQSLEUCttRhTNOn6UTt1aByBZzEmgAUCak41LgIbAgUJARDe
 NS4ACgkQtG7bTfwmgF2ogwEAtSjb9C8zSAsh206Xkil36P/FOrR2C7H2r7D5tv1b
 xKABAP05CbMhCLkmwq9kCluFaewsuA5VbsRlJ3d8c4hMXvEGbGYBAISOkpRSFDbo
 Bz44V34y+RXTClxl1sWhBcF9UCLgDtHXAP0Q+2JN1c+jWYidnStsq/eL+JV7qB4o
-ktfVqN0JwAtZDQ==
+ktfVqN0JwAtZDbgzBGqxLjoWCSsGAQQB2kcPAQEHQAAdXKPrN+mmhubNRfLVc1mS
-=6Fh2
+kcctf+mlDD3pk/AI9yQDiPUEGBYKACYWIQSLEUCttRhTNOn6UTt1aByBZzEmgAUC
+arEuOgIbAgUJAK3l9gCBCRB1aByBZzEmgHYgBBkWCgAdFiEEX0QEZ9FXLhHCqHgb
+FtXU38DDYCIFAmqxLjoACgkQFtXU38DDYCIluAD/QFH5kGfgBXxk6ZKur5wH7UT3
++MCrrI/4aXkcX2mLtS4A/0HTFQVVpQuz1MCYKA4TvAWqk7Xvkaje0FA4EjxmB6gI
+QiYBAIOXJEwrY11xQYVeyF61v1hXECQmpesuFkvrsU8g/5pxAQCb83nYoT0B9/7D
+w7241c+wF7LNOj9f5Bmhe1mdsFo2DA==
+=v4nh
 -----END PGP PUBLIC KEY BLOCK-----

snapshots/75681C8167312680-public_2026-09-21.asc

@@ -0,0 +1,77 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEak4yahYJKwYBBAHaRw8BAQdAs7q0+BT6idVC9u40uPHMtMJ6pUWGDimiR5z9
+2zvwmQW0JkFsZXhhbmRlciBIZXNzIDxhaEBhbGV4YW5kZXItaGVzcy5jb20+iJkE
+ExYKAEECGwEFCQEQ4eMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQSLEUCttRhT
+NOn6UTt1aByBZzEmgAUCak40jwIZAQAKCRB1aByBZzEmgD30AP9Vf7NrDSh3cpK2
+abbeYXvWbwQMMw60179e1k1oNfLI/QD+MzdeJGKNM6ax9ctoxX7JgHCND7u7oXXs
+RXzmfBYr1gaIdQQTFgoAHRYhBOiC7hUeuQcDEz3+n20RwekdOwJlBQJqTl43AAoJ
+EG0RwekdOwJlSF4BAI0zfXyQpLZM57ZjpOMpyBtuSC8JQ16rFA3HkQntk6G8AQD0
+xYrxnK4I2recHmbu/mfDUKLxcPIokf0ikSGCxSzuAokCMwQTAQoAHRYhBKtcDjGd
+dzUPumzxQzROpasQ2GjgBQJqTl6MAAoJEDROpasQ2Gjg0usP/iDeidFqr7d+G64f
+DTYYbqFyo/CEF0a7SImTgvpbnlGUdeSK5SHGjUb9dqNmr4p82Camw7ZIvgJumTBq
+g9VL4y6MiR/0CNMnKMu5lM/Vfi88N+WiXuaSGj9swCG+al5P/K4vUr8m6Zh7q1L9
+vFLsExznJJsYgDqslZoCbI1UfK1VgS5DLp7fimKXxXrqQaMKOP7+9QKIyD65b6Xe
+X5roOAy6KnzLD0ZWvhIbzI4fMrGOCiuoFdDT2DJLunBfsbI+bwP33uDTTSjkPbvw
+oRW9XOFH7x1raWZ8WmJHPc2nq+UA/zz9Z0TLgvw41NQ4PvbkhdZrInI1nH4MdiyI
+FgFDwptaKx1W6VlnIBre93hm518CZjoK/eWnizqRcgzaE4Jg3qyeP4LZJ6EURSHz
+LhpZ9dL6Y7ZxPDhEpPqsvnHMWX9vfUebSjxwu9zslvJw/s4qtscTaQ3MnoDOneQs
+6fgBo4Lmi5CVwklZNe6TYwastgdGcjAAXLFY2a8FEpKrBXtU6whC0j6zzcQPj4jx
+cRt9u4glpx/d0K6PhAPwI2pQegp1EKYs80AlYy+qXFdgVKtfhX/+7lBmYxktUEo/
+M0p4eD2tz8eaowRWpb74xTLuDvgBVb8OW1nMQm5Ri8ndk3j3W5tDqxVkf0UoO6vw
+fFfwzy6E4Wt+RplnztuLgmwAL1rPtClBbGV4YW5kZXIgSGVzcyA8YWxleGFuZGVy
+QHdlYmFydGlmZXguYml6PoiWBBMWCgA+FiEEixFArbUYUzTp+lE7dWgcgWcxJoAF
+AmpOM9MCGwEFCQEQ4eMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQdWgcgWcx
+JoDzgQEAlUbQuIeVH4mKeEVHcR+S5goKXwBb+XsmvLHp4blZ4qEBAJkXYkRXYcA7
+QcnqoHx2+2CHfDuUsAzh+ajQFoTY60ACiHUEExYKAB0WIQTogu4VHrkHAxM9/p9t
+EcHpHTsCZQUCak5ePwAKCRBtEcHpHTsCZWZHAQDjFg3r7Glga6gA5OvVPYOCbxdt
+8pz/rKsZOPhF0E9MaQD+J/mhkjgIZQfExy0UnjNyb3HbjGdg8j60gKuichKeewOJ
+AjMEEwEKAB0WIQSrXA4xnXc1D7ps8UM0TqWrENho4AUCak5ejQAKCRA0TqWrENho
+4A0LD/9kpsfNvsLmgqHY6/zuLWwGNMCXIymMnUxKu2naQxdOHP/JggHaepraby5K
+juvfRuyePZq0+9/3BVQMrbY+F2/WX0LQqxUbMvFtFEAwWgphxppvJClcOE1HRItb
+sxLgR8xRp19qLif9Qpr18b59TRNXfZhJGDqb6Ro0Cf7kLIkLXRRMC6/bIsKzBuB7
+gB+msxy+PkdJb8WkYmSlFJpcm7O2cV09qwH87bCtEGdd7n/wK28E5YymjlJlnXxd
+Sxtr6koy/jurX7hyEjquZ4h/+C7IfR2rgJZFvV/oma0grWkenf3cINigjs5OSVwW
+4dB9lKmlOP9gho+56679UWP0HVOS3kUCEY/xO2jOh9uYXT9shYlGwEH7KOlHSsfB
+ZyWcoKKW5eDdJrzJY2MUjTfcYhvls2v38wVig/pne5WxN08x1fbpLoBKv0hu5dEH
+RLA/iaeBzTAt2AQRQQBADBWzZk0K3qM9anf0qdZmfG+ipLbbLjlOW3KdGRTdSRiU
+ueByB7gyYKXzIHOmXqT//H0+itgBwcCN8MUc62MRL+YJ1kPoCGNV+ugFs5RboxR0
+x+bk3u1fE6XFhAyDRcR91L6ugNEn4SFQcGHPUrDB55nyOO7Tocj4W2UM1QS2WDNy
+/AbYRfL4zAEY5YmC5BhVnyjb3/kUkOGzT1JyyeZBG/o+xaQNRrQoQWxleGFuZGVy
+IEhlc3MgPGFsZXhhbmRlckB3ZWJhcnRpZmV4LmRlPoiWBBMWCgA+AhsBBQkBEOHj
+BQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEixFArbUYUzTp+lE7dWgcgWcxJoAF
+AmpONI8ACgkQdWgcgWcxJoCtdAEAwAaSk3vkAJN/nGaNB+BKO9czcjWSSN4g9JYz
+peVojU4A/1ndGCaEalLnCcnJmHNYFhM82bsfMFGrckKgod3lu9wFiHUEExYKAB0W
+IQTogu4VHrkHAxM9/p9tEcHpHTsCZQUCak5ePwAKCRBtEcHpHTsCZQbwAQCk5nse
+Cp3k+lFyy8gvbvcD9XI/oD+FnuF/CScQm0p9vAEA0K1xN6SWI2OVsNTh/nezfAr2
+vETMUFBhtfMY7Im1AAaJAjMEEwEKAB0WIQSrXA4xnXc1D7ps8UM0TqWrENho4AUC
+ak5ejQAKCRA0TqWrENho4LrSD/9gKFDaaeF5yiTPiiJFrlaQ1chYrHy7nuLcHpgt
+uMC2HGlExVyFGxooiGCgijyxgXXxgMD7X3LBYc89qL0j5YjndSfltmyQxsvGVZvo
+vXn/grMS1l8Gnz0yLNSmBfHrPHlpAaXIZU4jv/zum+xebWStDWvwuDloEQ/G8NEe
+IukHFKT646PrwTSPFU1nObmsrUcRNZf/Luw1XGOSV1nyINrYcTGrdDMYgu4IqHF9
+nNovHsOKr30P7RbglLzxcRiRVjeOK40YUYhdfzgXacNm0kdPIVc34n/RZWAxGaRG
+7F4TBZqZqFwDqKhwdGY3YNCr11+ydqXMsOPcAEIlX8yyQw7hv3hIapmmkkK0wx7H
+lBiDhNWWYxFgzh4imZg3xzOhkBltzCsJvfxe1Av04hMEnGL7bnFAVybqKB8XbtL1
+L0lds3gWZG4XZw7+y45GCiVHaeWTqXJpnozESOcX0AeN+azfxbkBMRF59I7HAs4d
+bLxA9rnnnUYXpXt5x1UXs6ZNPGiVYWn4CXqwvab/xk+M8JnCqqxaydZxi92oqkRN
+odiVI9lu2t3b8wtkpEVzygMGJP48N949VwqMnAECFATOeT9nqDubIoa3NF/ph5Cw
+I3SGHs2gDLWZXv+Bdlsi9xbi9K/Ima21LItFLDDU2Q37/lS28GlfaJACK9TmK6BN
+DDHdfbg4BGpONP0SCisGAQQBl1UBBQEBB0Auh/Z95jnIeEjfulzBYSmsEs83pbpO
+SgbAdlDqId1BaAMBCAeIfgQYFgoAJhYhBIsRQK21GFM06fpRO3VoHIFnMSaABQJq
+TjT9AhsMBQkBEN8fAAoJEHVoHIFnMSaAIMcBANtQlsya/TfaSRTazAtBe+n7PdqX
+GbCuEllKFerSAXUAAQCz8txVvInbh6fuXyIkEW7japZML3jbVwkp007tRq5KCrgz
+BGpONS4WCSsGAQQB2kcPAQEHQMBrbhqUWKSBFiZ/kUTFBHt5icyI9ba7acWR70S5
+XB7OiPUEGBYKACYWIQSLEUCttRhTNOn6UTt1aByBZzEmgAUCak41LgIbAgUJARDe
+8ACBCRB1aByBZzEmgHYgBBkWCgAdFiEE1tGYnfH2sj/Xdik9tG7bTfwmgF0FAmpO
+NS4ACgkQtG7bTfwmgF2ogwEAtSjb9C8zSAsh206Xkil36P/FOrR2C7H2r7D5tv1b
+xKABAP05CbMhCLkmwq9kCluFaewsuA5VbsRlJ3d8c4hMXvEGbGYBAISOkpRSFDbo
+Bz44V34y+RXTClxl1sWhBcF9UCLgDtHXAP0Q+2JN1c+jWYidnStsq/eL+JV7qB4o
+ktfVqN0JwAtZDbgzBGqxLjoWCSsGAQQB2kcPAQEHQAAdXKPrN+mmhubNRfLVc1mS
+kcctf+mlDD3pk/AI9yQDiPUEGBYKACYWIQSLEUCttRhTNOn6UTt1aByBZzEmgAUC
+arEuOgIbAgUJAK3l9gCBCRB1aByBZzEmgHYgBBkWCgAdFiEEX0QEZ9FXLhHCqHgb
+FtXU38DDYCIFAmqxLjoACgkQFtXU38DDYCIluAD/QFH5kGfgBXxk6ZKur5wH7UT3
++MCrrI/4aXkcX2mLtS4A/0HTFQVVpQuz1MCYKA4TvAWqk7Xvkaje0FA4EjxmB6gI
+QiYBAIOXJEwrY11xQYVeyF61v1hXECQmpesuFkvrsU8g/5pxAQCb83nYoT0B9/7D
+w7241c+wF7LNOj9f5Bmhe1mdsFo2DA==
+=v4nh
+-----END PGP PUBLIC KEY BLOCK-----