# `age` Key Documentation

This document specifies how I maintain my [age](https://github.com/FiloSottile/age) key.

It is (re-)signed with the current OpenPGP key:

```bash
./scripts/sign.sh AGE.md  # to produce AGE.md.asc

gpg --verify AGE.md.asc AGE.md
```


## Current Key

> `age1gzy6tj8y93ljuelcedrkcsv3p6gygk7ng3386u32av9a4ujh737qef8crp`

| Field    | Value                                      |
|----------|--------------------------------------------|
| Type     | X25519 (native age identity)               |
| Created  | 2026-09-11                                 |
| Expires  | never (because `age` has no expiry)        |
| Deployed | all machines, `~/.config/age/identity.txt` |


### Policies

- One identity on all machines,
  like the OpenPGP `[E]` subkey
- No expiry and no revocation:
  Rotation means replacing the key
  in this file, in [`KEYS.md`](KEYS.md), and in [`age-recipient.txt`](age-recipient.txt),
  recording it in [`ceremonies/`](ceremonies/),
  running `./scripts/sign.sh` to re-sign the signed documents, and
  encrypting anything that matters again
- The OpenPGP signature on this file is the trust anchor;
  [`age-recipient.txt`](age-recipient.txt) is a convenience copy for `age -R`


### Storage

- Secret key: In my **Vaultwarden** as secure note "age Identity"
  (because they are offline-synced text, unlike attachments)
- Public record: **This repository**
  - [`AGE.md`](AGE.md)
  - [`age-recipient.txt`](age-recipient.txt)
- Distribution: My **public websites**
  - [alexander-hess.com](https://www.alexander-hess.com/age-recipient.txt)
    ([Policies](https://www.alexander-hess.com/AGE.md),
     [Signature](https://www.alexander-hess.com/AGE.md.asc))
  - [webartifex.de](https://www.webartifex.de/age-recipient.txt)
    ([Policies](https://www.webartifex.de/AGE.md),
     [Signature](https://www.webartifex.de/AGE.md.asc))


## Ceremonies

- Introduction of this key:
  [`ceremonies/2026-09-13_age_key.md`](ceremonies/2026-09-13_age_key.md)
- A future rotation gets its own record in [`ceremonies/`](ceremonies/),
  signed with the OpenPGP key of that day