- Add AGE.md with policies
- Add age-recipient.txt for `age -R`
- Add ceremonies/2026-09-13_age_key.md as the signed record
of which recipient is valid from which date
- List the recipient in KEYS.md
- Describe AGE.md and age-recipient.txt in README.md
- Extend the scripts:
+ sign.sh signs AGE.md by default
+ verify.sh verifies AGE.md by default
and cross-checks age-recipient.txt,
the only unsigned artifact,
against the recipient in the signed KEYS.md and AGE.md
Executed the full supersession ceremony:
- ceremonies/: signed record of the supersession
(signed by both old keys plus the new one)
- history/: added final states of
344EA5AB10D868E0 (main key from 2020 to 2026) and
6D11C1E91D3B0265 (main key for 5 months in 2026),
both revoked as "superseded" and cross-certifying the new key
- snapshots/: first export of 75681C8167312680 as published,
certified by both predecessors, verified on keys.openpgp.org
- the UID alexander@hess.software is revoked and withdrawn
All five keyservers, WKD (three domains), and the `git` forges
serve only the new key from now on.
