Keys

These are the digital keys I use to sign and protect things. If you've got something that says it's from me, like a signed PDF, a signed email or a code commit, this page helps you check that it's genuine and hasn't been changed.

Downloads

PGP key for email and files
Root certificate for PDFs
SSH key for servers
keys.txt signed list of everything

Check something

Paste a signed message, a signature, a key, a certificate or a fingerprint, or drop a file here. It's checked in your browser; nothing is uploaded.

This is a convenience. If you need certainty, verify keys.txt yourself with my PGP key from another source (see how to trust this page).

Signed PDFs

Adobe Acrobat may say my signature's identity is unknown. That's expected: my certificate comes from my own certificate authority rather than a paid one. To trust it once for every document I sign:

Click my signature, then Signature Properties → Show Signer's Certificate.
Select the top certificate and check its SHA-1 matches DE:03:4F:80:E6:69:4B:54:42:50:A6:1B:E0:B3:BA:9C:FE:A3:1D:23.
On the Trust tab, choose Add to Trusted Certificates and tick Use this certificate as a trusted root.

Email and files

Use my PGP key to send me something encrypted or to check something I've signed. Most PGP tools can fetch it from my email address:

gpg --locate-keys ben@bensoyka.com

Its fingerprint is BC48 76BD C8AB 5AB8 C9CB 8165 9497 E305 83D6 8D89

Code and servers

My Git commits are signed with my PGP key, so GitHub marks them Verified. To give me SSH access, add my SSH key:

curl -s https://keys.bensoyka.com/ssh.txt >> ~/.ssh/authorized_keys

All my keys

Main PGP key In use

My main key. Use it to send me encrypted messages or to check things I've signed: emails, files, Git commits, and this list. Its everyday parts live on a hardware security key and can't be copied off it; the master part is kept offline. Its authentication part doubles as my SSH key.

Fingerprint: BC48 76BD C8AB 5AB8 C9CB 8165 9497 E305 83D6 8D89
Download: 9497E30583D68D89.asc

More details

Identities: Benjamin Soyka <ben@bensoyka.com>
Ben Soyka <soyka006@umn.edu>
Benjamin Soyka <bensoyka6@gmail.com>
Dates: Created 2026-08-21, renewed before 2029-08-20
Parts: Sign: C7B826D38555AFA3AE7FA216F201E8FA2D72139F
Encrypt: 411A48120A5A2F1DC85CDD67AEE88FCE4521BF59
Auth: 4CD451BCEC8DB32C03B5026CC83BA4E193E4483E
Vouched for by: Wikipedia PGP key, 2026-08-21, on ben@bensoyka.com, soyka006@umn.edu
Private key: Held. Everyday parts on a hardware security key; full key in an offline, passphrase-protected backup.

My root certificate authority In use

The one certificate to trust. It only certifies my own certificate authorities, its key is kept offline, and nothing below it can create further authorities. Trust it once and every document I sign will show as valid, including after I renew my signing certificate.

SHA-256: D4:5F:98:89:C7:03:62:AD:9B:AE:4C:E2:DF:AF:2B:B8:FD:0F:B2:E3:14:B4:1A:33:64:99:3B:B3:2B:8F:B5:6A
Download: root.crt · revocation list

More details

SHA-1: DE:03:4F:80:E6:69:4B:54:42:50:A6:1B:E0:B3:BA:9C:FE:A3:1D:23
Valid: 2026-11-09 to 2046-11-09
Subject: Benjamin Soyka Root CA
Private key: Held offline, encrypted to my main PGP key.

My personal certificate authority In use

Sits under the root and issues the certificates I personally sign with. Its key is also kept offline. You don't need to trust it separately.

SHA-256: 7A:42:74:CB:C0:BB:0D:AB:5F:CC:E4:9D:51:A6:18:36:E2:4D:73:70:15:9E:60:84:64:30:14:84:8B:67:57:4C
Download: personal-ca.crt · revocation list

More details

SHA-1: C7:E9:9D:5C:62:BF:CF:48:E0:88:27:88:27:70:CE:BD:93:74:CB:01
Valid: 2026-11-09 to 2036-11-09
Subject: Benjamin Soyka Personal CA
Issued by: Benjamin Soyka Root CA
Private key: Held offline, encrypted to my main PGP key.

Document signing certificate In use

What I sign PDFs with. Its private key was created on a hardware security key and can't be copied off it; the attestation file proves that, checkable against the hardware maker's own certificate authority.

SHA-256: 3D:BE:D5:A3:FC:D4:17:8C:AD:FF:FE:A9:4C:97:D9:CB:8C:7A:D6:43:5A:15:56:6B:F0:88:9F:2A:17:EB:83:18
Download: docsign-primary.crt · attestation · attestation chain

More details

SHA-1: 73:67:FE:F2:3D:54:34:A6:C9:65:0E:67:60:CE:D6:23:FA:CC:BA:2A
Valid: 2026-11-09 to 2031-11-09
Subject: Benjamin Soyka <ben@bensoyka.com>
Issued by: Benjamin Soyka Personal CA
Private key: On a hardware security key only. It can't be copied off, so there is no backup; if the hardware is lost I issue a new certificate.

Document signing certificate (backup) In use

The same as above, on my backup hardware key, so I can still sign if the first one is lost. Signatures from either are equally mine.

SHA-256: BF:B9:C5:37:09:42:5B:11:8E:4F:72:13:32:73:61:6E:F3:4A:74:1D:E4:E9:83:D7:EE:DA:42:2C:D5:6A:C5:8B
Download: docsign-backup.crt · attestation · attestation chain

More details

SHA-1: 6B:70:9C:F4:17:1A:F0:B5:2E:C2:41:31:58:1B:34:E6:91:E1:1E:7D
Valid: 2026-11-09 to 2031-11-09
Subject: Benjamin Soyka <ben@bensoyka.com>
Issued by: Benjamin Soyka Personal CA
Private key: On a second hardware security key, kept somewhere safe. Can't be copied off.

SSH key In use

The authentication part of my main PGP key.

Fingerprint: SHA256:TxH6cyjCV4IEPwmOj4R3NR/eWfgPXSWmU0DuInmLLOY
Download: ssh.txt

More details

Key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF9pJPHws9mluZNCA65sUu4TgH/1gKVVPUlW7vdqkNtN openpgp:0x93E4483E

Wikipedia PGP key In use

A separate key for Wikipedia-related correspondence as User:Bsoyka, also published on my Wikipedia user page. Rarely used, but still active.

Fingerprint: 13AB AA10 7960 069C 2D1B F9D0 D193 7DCD F9A5 24BC
Download: D1937DCDF9A524BC.asc

More details

Identities: Bsoyka <bsoyka.wikipedia@gmail.com>
Dates: Created 2022-12-24
Parts: Encrypt: 582908A0B8A1C66BACD0FBA48151FB3DB546C371
Private key: Held, in an offline, passphrase-protected backup.

Keyoxide profile In use

Links my domains and accounts to my main PGP key. Keyoxide checks each link live, in both directions.

Profile: keyoxide.org
Identifier: aspe:keys.bensoyka.com:NGXUYTLMNMHQGGMPHUDLAWXOLY

More details

Claims: openpgp4fpr:bc4876bdc8ab5ab8c9cb81659497e30583d68d89
dns:bensoyka.com?type=TXT
dns:bsoyka.me?type=TXT
https://gist.github.com/bsoyka/cba00e8777bcccad246129bcb2e7e15d
Private key: Held offline, encrypted to my main PGP key.

Backup encryption keys In use

My backups are encrypted to these three age keys before they leave my computer; any one of them can decrypt. They're listed so you can tell they're mine, not because anyone else needs to encrypt to them.

Key 1: age1pq1jvsuzdqq…f56z7eg4
Key 2: age1pq1gtugz8xs…fgxfgre8
Key 3: age1pq1cn6quhpu…pqzynkgk
Download: backups.txt

More details

Key 1 private key: Held offline, split into parts kept by different people.
Key 2 private key: Held offline.
Key 3 private key: Held in my password manager.

Retired and compromised (4)

Kept so old signatures can still be checked. Don't encrypt to these or start trusting them.

Previous PGP key (2021-2026) Retired

Replaced on 2026-08-21 as routine maintenance, not because anything went wrong. Signatures it made before then are still genuine. Don't encrypt to it.

Fingerprint: 0CA7 CC16 A64B 68F3 048E E8FE A5E7 26D5 A652 28EA
Download: A5E726D5A65228EA.asc

More details

Identities: Benjamin Soyka <hello@bsoyka.me>
Benjamin Soyka <bensoyka@icloud.com>
Benjamin Soyka <michael.soyka3@gmail.com>
Benjamin Soyka
Benjamin Soyka <bensoyka6@gmail.com>
Benjamin Soyka <soyka006@umn.edu>
Dates: Created 2021-01-24, retired 2026-08-21
Parts: Encrypt: EB2968D0F1DD9B0CB9767E907BED20103FBB4DB5
Vouched for by: Main PGP key, 2026-08-21, on hello@bsoyka.me, Benjamin Soyka, bensoyka6@gmail.com, soyka006@umn.edu
Private key: Held offline, encrypted to my main key, only to decrypt old messages.

Original PGP key (2020-2025) Retired

Revoked 2025-07-19. Listed for completeness.

Fingerprint: 91FA 6964 6625 ECAB 5DE4 A697 3779 9464 147A 3418
Download: 37799464147A3418.asc

More details

Identities: Benjamin Soyka <bensoyka@icloud.com>
Dates: Created 2020-06-15, retired 2025-07-19
Parts: Encrypt: 287579F9963C99D75B1DF38B20A81F2E9E522C59
Private key: Held offline, passphrase-protected, only to decrypt old messages.

Earlier signing certificate (Aug–Nov 2026) Retired

Used to sign documents from August to November 2026, with its key stored on hardware. A software copy of the key existed and was shared outside my control on 2026-11-09, so it's retired as of then. Documents I sent before that are genuine; if in doubt, ask me.

SHA-256: 05:6C:87:36:8D:AA:9A:FE:78:63:29:0C:0C:D2:4E:84:A4:62:13:83:D7:EA:31:5D:AF:00:95:52:95:E7:32:BA
Download: 2026-08-24-p256-signing.crt

More details

SHA-1: E9:7B:60:49:4F:0C:BE:1C:71:10:CF:C4:BF:F2:5C:9F:54:A1:7D:40
Valid: 2026-08-24 to 2036-08-21
Subject: CN=Benjamin Soyka
Private key: Was on a hardware security key, but a software copy existed and was shared outside my control on 2026-11-09. Removed from the hardware and all copies deleted.

Keybase Retired

My old Keybase proof stays up so existing checks don't break, but Keybase isn't maintained anymore. My accounts are now linked to my key on Keyoxide.

More details

Private key: Keybase's own device keys, not part of this setup.

How to trust this page

Everything here comes from keys.txt, which is signed with my main PGP key. A website can be tampered with, so for anything important, get my key from somewhere else too (keys.openpgp.org, GitHub, or me in person) and check:

curl -s https://keys.bensoyka.com/keys.txt | gpg --verify

The signature should come from BC48 76BD C8AB 5AB8 C9CB 8165 9497 E305 83D6 8D89.

My domains and accounts are linked to this key on Keyoxide, which checks each link independently.

bensoyka.com
Source
Email me