Alexander Hess
ae768285b6
- Add AGE.md with policies
- Add age-recipient.txt for `age -R`
- Add ceremonies/2026-09-13_age_key.md as the signed record
of which recipient is valid from which date
- List the recipient in KEYS.md
- Describe AGE.md and age-recipient.txt in README.md
- Extend the scripts:
+ sign.sh signs AGE.md by default
+ verify.sh verifies AGE.md by default
and cross-checks age-recipient.txt,
the only unsigned artifact,
against the recipient in the signed KEYS.md and AGE.md
61 lines
2.1 KiB
Markdown
61 lines
2.1 KiB
Markdown
# `age` Key Documentation
|
|
|
|
This document specifies how I maintain my [age](https://github.com/FiloSottile/age) key.
|
|
|
|
It is (re-)signed with the current OpenPGP key:
|
|
|
|
```bash
|
|
./scripts/sign.sh AGE.md # to produce AGE.md.asc
|
|
|
|
gpg --verify AGE.md.asc AGE.md
|
|
```
|
|
|
|
|
|
## Current Key
|
|
|
|
> `age1gzy6tj8y93ljuelcedrkcsv3p6gygk7ng3386u32av9a4ujh737qef8crp`
|
|
|
|
| Field | Value |
|
|
|----------|--------------------------------------------|
|
|
| Type | X25519 (native age identity) |
|
|
| Created | 2026-09-11 |
|
|
| Expires | never (because `age` has no expiry) |
|
|
| Deployed | all machines, `~/.config/age/identity.txt` |
|
|
|
|
|
|
### Policies
|
|
|
|
- One identity on all machines,
|
|
like the OpenPGP `[E]` subkey
|
|
- No expiry and no revocation:
|
|
Rotation means replacing the key
|
|
in this file, in [`KEYS.md`](KEYS.md), and in [`age-recipient.txt`](age-recipient.txt),
|
|
recording it in [`ceremonies/`](ceremonies/),
|
|
running `./scripts/sign.sh` to re-sign the signed documents, and
|
|
encrypting anything that matters again
|
|
- The OpenPGP signature on this file is the trust anchor;
|
|
[`age-recipient.txt`](age-recipient.txt) is a convenience copy for `age -R`
|
|
|
|
|
|
### Storage
|
|
|
|
- Secret key: In my **Vaultwarden** as secure note "age Identity"
|
|
(because they are offline-synced text, unlike attachments)
|
|
- Public record: **This repository**
|
|
- [`AGE.md`](AGE.md)
|
|
- [`age-recipient.txt`](age-recipient.txt)
|
|
- Distribution: My **public websites**
|
|
- [alexander-hess.com](https://www.alexander-hess.com/age-recipient.txt)
|
|
([Policies](https://www.alexander-hess.com/AGE.md),
|
|
[Signature](https://www.alexander-hess.com/AGE.md.asc))
|
|
- [webartifex.de](https://www.webartifex.de/age-recipient.txt)
|
|
([Policies](https://www.webartifex.de/AGE.md),
|
|
[Signature](https://www.webartifex.de/AGE.md.asc))
|
|
|
|
|
|
## Ceremonies
|
|
|
|
- Introduction of this key:
|
|
[`ceremonies/2026-09-13_age_key.md`](ceremonies/2026-09-13_age_key.md)
|
|
- A future rotation gets its own record in [`ceremonies/`](ceremonies/),
|
|
signed with the OpenPGP key of that day
|