- Add scripts/security-txt.sh
to generate a security.txt file
- Add the current security.txt
- Extend verify.sh to verify security.txt by default
and cross-check that it expires together with the signing key
- Describe security.txt in OPENPGP.md and README.md
- Add AGE.md with policies
- Add age-recipient.txt for `age -R`
- Add ceremonies/2026-09-13_age_key.md as the signed record
of which recipient is valid from which date
- List the recipient in KEYS.md
- Describe AGE.md and age-recipient.txt in README.md
- Extend the scripts:
+ sign.sh signs AGE.md by default
+ verify.sh verifies AGE.md by default
and cross-checks age-recipient.txt,
the only unsigned artifact,
against the recipient in the signed KEYS.md and AGE.md
- Make OpenPGP only one of many protocols
+ KEYS.md only holds the current keys
+ OPENPGP.md describes all OpenPGP details
- Make the current public key available at the root
- Add scripts/ to automate the various steps:
+ bootstrap.sh
+ publish.sh
+ sign.sh
+ snapshot.sh
+ verify.sh
Executed the full supersession ceremony:
- ceremonies/: signed record of the supersession
(signed by both old keys plus the new one)
- history/: added final states of
344EA5AB10D868E0 (main key from 2020 to 2026) and
6D11C1E91D3B0265 (main key for 5 months in 2026),
both revoked as "superseded" and cross-certifying the new key
- snapshots/: first export of 75681C8167312680 as published,
certified by both predecessors, verified on keys.openpgp.org
- the UID alexander@hess.software is revoked and withdrawn
All five keyservers, WKD (three domains), and the `git` forges
serve only the new key from now on.
