The subkey 16D5D4DFC0C36022 lives only on the project's machines,
with its own passphrase, and expires together with the primary key
on 2027-01-31
- Add the subkey to the table in OPENPGP.md
- Replace the 6-month expiry policy for external subkeys: they now
follow the yearly update and are revoked as "retired" at project end
- Export the updated public key and a dated snapshot
- Re-sign OPENPGP.md
Snapshots are now written as <KEYID>-public_YYYY-MM-DD.asc,
one file per ceremony, matching the naming of the secret exports
kept outside this repository
Executed the full supersession ceremony:
- ceremonies/: signed record of the supersession
(signed by both old keys plus the new one)
- history/: added final states of
344EA5AB10D868E0 (main key from 2020 to 2026) and
6D11C1E91D3B0265 (main key for 5 months in 2026),
both revoked as "superseded" and cross-certifying the new key
- snapshots/: first export of 75681C8167312680 as published,
certified by both predecessors, verified on keys.openpgp.org
- the UID alexander@hess.software is revoked and withdrawn
All five keyservers, WKD (three domains), and the `git` forges
serve only the new key from now on.
