# OpenPGP Key Documentation & Ceremonies

This document specifies how the PGP keys are maintained
    for Alexander Hess (i.e., "me" in the following).
It is re-signed at every ceremony, like so:

```bash
gpg --detach-sign --armor KEYS.md  # to produce KEYS.md.asc

gpg --verify KEYS.md.asc KEYS.md
```


## Current Key

> PLACEHOLDER


| Field       | Value                                                 |
|-------------|-------------------------------------------------------|
| Fingerprint | `XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX`  |
| Key ID      | `XXXXXXXXXXXXXXXX` (fingerprint's last 16 chars)      |
| Primary     | ed25519 `[C]` OFFLINE (i.e., `sec#` on all machines)  |
| Subkey 1    | cv25519 `[E]`                                         |
| Subkey 2    | ed25519 `[S]` internal                                |
| Created     | 2026-MM-DD                                            |
| Expires     | always **End of January** (next: 2027-MM-DD)          |
| Primary UID | `Alexander Hess <ah@alexander-hess.com>`              |
| Other UID 1 | `Alexander Hess <alexander@webartifex.biz>`           |
| Other UID 2 | `Alexander Hess <alexander@webartifex.de>`            |


### Subkeys

| Key ID             | Type | Purpose                    | Expires    |
|--------------------|------|----------------------------|------------|
| `XXXXXXXXXXXXXXXX` | E    | encryption                 | 2027-01-31 |
| `XXXXXXXXXXXXXXXX` | S    | signing on my own machines | 2027-01-31 |


### Policies

- All parts (primary and every subkey) expire at the **end of January**
  so the update ceremony in **early January** has a brief grace period
- No `[A]` subkey: SSH stays separate in `~/.ssh`
  because I prefer defaults over cleverness
- Internal `[S]` subkey pinned everywhere with bang syntax (`<FPR>!`)
  because I never want to rely on GPG's newest-subkey auto-selection
- External `[S]` subkeys per client engagement
  with shorter 6-month expiry living on client machines


### Storage

- Secret material: **Vaultwarden** as secure notes
  (because they are offline-synced text, unlike attachments):
  - Armored export of the primary secret key
  - Revocation certificate, generated at key creation
- Public record: **this repo**:
  - `KEYS.md` and detached signature `KEYS.md.asc`
  - `snapshots/<KEYID>-public-YYYY.asc`, committed at every ceremony
  - One commit per ceremony to keep
    snapshot, changelog, and re-signed `KEYS.md` together
- Distribution:
  - WKD on all three UID domains
  - public keyservers (see section below)
  - public websites
    because this repo is the archive and not the channel:
    - [alexander-hess.com](https://www.alexander-hess.com/KEYS.md)
      ([Signature](https://www.alexander-hess.com/KEYS.md.asc))
    - [webartifex.biz](https://www.webartifex.biz/KEYS.md)
      ([Signature](https://www.webartifex.biz/KEYS.md.asc))
    - [webartifex.de](https://www.webartifex.de/KEYS.md)
      ([Signature](https://www.webartifex.de/KEYS.md.asc))
- Machines: subkeys only
  via `gpg --export-secret-subkeys <FPR>!` => keyring shows `sec#`
- Rationale: secrets and public record in independent systems;
  so, either one alone suffices to recover or verify the other


### Publication to Keyservers

````bash
FPR=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

for KS in \
    hkps://keys.openpgp.org \
    hkps://keyserver.ubuntu.com \
    hkps://pgpkeys.eu \
    hkps://pgp.mit.edu \
    hkps://keyserver.escomposlinux.org; do
  echo "=== $KS ==="
  gpg --keyserver "$KS" --send-keys "$FPR"
done
````

- `keys.openpgp.org` strips UIDs until each address is verified
  => Click the links mailed to all addresses
- *Hockeypuck* servers (the other four) are append-only: They merge and never delete
  => Run after *every* change