keys/KEYS.md

OpenPGP Key Documentation & Ceremonies

This document specifies how the PGP keys are maintained for Alexander Hess (i.e., "me" in the following). It is re-signed at every ceremony, like so:

gpg --detach-sign --armor KEYS.md  # to produce KEYS.md.asc

gpg --verify KEYS.md.asc KEYS.md

Current Key

PLACEHOLDER

Field	Value
Fingerprint	XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
Key ID	XXXXXXXXXXXXXXXX (fingerprint's last 16 chars)
Primary	ed25519 [C] OFFLINE (i.e., sec# on all machines)
Subkey 1	cv25519 [E]
Subkey 2	ed25519 [S] internal
Created	2026-MM-DD
Expires	always End of January (next: 2027-MM-DD)
Primary UID	Alexander Hess <ah@alexander-hess.com>
Other UID 1	Alexander Hess <alexander@webartifex.biz>
Other UID 2	Alexander Hess <alexander@webartifex.de>

Subkeys

Key ID	Type	Purpose	Expires
XXXXXXXXXXXXXXXX	E	encryption	2027-01-31
XXXXXXXXXXXXXXXX	S	signing on my own machines	2027-01-31

Policies

• All parts (primary and every subkey) expire at the end of January so the update ceremony in early January has a brief grace period
• No [A] subkey: SSH stays separate in ~/.ssh because I prefer defaults over cleverness
• Internal [S] subkey pinned everywhere with bang syntax (<FPR>!) because I never want to rely on GPG's newest-subkey auto-selection
• External [S] subkeys per client engagement with shorter 6-month expiry living on client machines

Storage

• Secret material: Vaultwarden as secure notes (because they are offline-synced text, unlike attachments):
  • Armored export of the primary secret key
  • Revocation certificate, generated at key creation
• Public record: this repo:
  • KEYS.md and detached signature KEYS.md.asc
  • snapshots/<KEYID>-public-YYYY.asc, committed at every ceremony
  • One commit per ceremony to keep snapshot, changelog, and re-signed KEYS.md together
• Distribution:
  • WKD on all three UID domains
  • public keyservers (see section below)
  • public websites because this repo is the archive and not the channel:
    • alexander-hess.com (Signature)
    • webartifex.biz (Signature)
    • webartifex.de (Signature)
• Machines: subkeys only via gpg --export-secret-subkeys <FPR>! => keyring shows sec#
• Rationale: secrets and public record in independent systems; so, either one alone suffices to recover or verify the other

Publication to Keyservers

FPR=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

for KS in \
    hkps://keys.openpgp.org \
    hkps://keyserver.ubuntu.com \
    hkps://pgpkeys.eu \
    hkps://pgp.mit.edu \
    hkps://keyserver.escomposlinux.org; do
  echo "=== $KS ==="
  gpg --keyserver "$KS" --send-keys "$FPR"
done

• keys.openpgp.org strips UIDs until each address is verified => Click the links mailed to all addresses
• Hockeypuck servers (the other four) are append-only: They merge and never delete => Run after every change