Alexander Hess
ae768285b6
- Add AGE.md with policies
- Add age-recipient.txt for `age -R`
- Add ceremonies/2026-09-13_age_key.md as the signed record
of which recipient is valid from which date
- List the recipient in KEYS.md
- Describe AGE.md and age-recipient.txt in README.md
- Extend the scripts:
+ sign.sh signs AGE.md by default
+ verify.sh verifies AGE.md by default
and cross-checks age-recipient.txt,
the only unsigned artifact,
against the recipient in the signed KEYS.md and AGE.md
2.1 KiB
2.1 KiB
age Key Documentation
This document specifies how I maintain my age key.
It is (re-)signed with the current OpenPGP key:
./scripts/sign.sh AGE.md # to produce AGE.md.asc
gpg --verify AGE.md.asc AGE.md
Current Key
age1gzy6tj8y93ljuelcedrkcsv3p6gygk7ng3386u32av9a4ujh737qef8crp
| Field | Value |
|---|---|
| Type | X25519 (native age identity) |
| Created | 2026-09-11 |
| Expires | never (because age has no expiry) |
| Deployed | all machines, ~/.config/age/identity.txt |
Policies
- One identity on all machines,
like the OpenPGP
[E]subkey - No expiry and no revocation:
Rotation means replacing the key
in this file, in
KEYS.md, and inage-recipient.txt, recording it inceremonies/, running./scripts/sign.shto re-sign the signed documents, and encrypting anything that matters again - The OpenPGP signature on this file is the trust anchor;
age-recipient.txtis a convenience copy forage -R
Storage
- Secret key: In my Vaultwarden as secure note "age Identity" (because they are offline-synced text, unlike attachments)
- Public record: This repository
- Distribution: My public websites
Ceremonies
- Introduction of this key:
ceremonies/2026-09-13_age_key.md - A future rotation gets its own record in
ceremonies/, signed with the OpenPGP key of that day