-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Key manifest: Benjamin Soyka https://keys.bensoyka.com/keys.txt This file is clearsigned with my primary PGP key: BC48 76BD C8AB 5AB8 C9CB 8165 9497 E305 83D6 8D89 It is the authoritative list of my keys and certificates. If something claims to be my key and isn't listed here as current, don't trust it. The signature date is the date of this version. ====================================================================== CURRENT ====================================================================== [PGP] Main PGP key Fingerprint: BC48 76BD C8AB 5AB8 C9CB 8165 9497 E305 83D6 8D89 Type: ed25519, created 2026-08-21 (current) UID: Benjamin Soyka UID: Ben Soyka UID: Benjamin Soyka Subkey: C7B826D38555AFA3AE7FA216F201E8FA2D72139F Sign, ed25519, expires 2029-08-20 Subkey: 411A48120A5A2F1DC85CDD67AEE88FCE4521BF59 Encrypt, cv25519, expires 2029-08-20 Subkey: 4CD451BCEC8DB32C03B5026CC83BA4E193E4483E Auth, ed25519, expires 2029-08-20 Certified: Wikipedia PGP key, 2026-08-21, on ben@bensoyka.com, soyka006@umn.edu Private key: Held. Everyday parts on a hardware security key; full key in an offline, passphrase-protected backup. Download: https://keys.bensoyka.com/pgp/BC4876BDC8AB5AB8C9CB81659497E30583D68D89.asc https://keys.bensoyka.com/pgp.asc Lookup: gpg --locate-keys ben@bensoyka.com (WKD) My main key. Use it to send me encrypted messages or to check things I've signed: emails, files, Git commits, and this list. Its everyday parts live on a hardware security key and can't be copied off it; the master part is kept offline. Its authentication part doubles as my SSH key. [PGP] Wikipedia PGP key Fingerprint: 13AB AA10 7960 069C 2D1B F9D0 D193 7DCD F9A5 24BC Type: rsa4096, created 2022-12-24 (current) UID: Bsoyka Subkey: 582908A0B8A1C66BACD0FBA48151FB3DB546C371 Encrypt, rsa4096 Private key: Held, in an offline, passphrase-protected backup. Download: https://keys.bensoyka.com/pgp/13ABAA107960069C2D1BF9D0D1937DCDF9A524BC.asc A separate key for Wikipedia-related correspondence as User:Bsoyka, also published on my Wikipedia user page. Rarely used, but still active. [SSH] Authentication subkey of the primary PGP key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF9pJPHws9mluZNCA65sUu4TgH/1gKVVPUlW7vdqkNtN openpgp:0x93E4483E Download: https://keys.bensoyka.com/ssh.txt [X.509 ROOT] My root certificate authority Subject: Benjamin Soyka Root CA Serial: 936DB68EE8744CF5F0A2656BF8CEE3F8 Valid: 2026-11-09 to 2046-11-09 SHA-256: D4:5F:98:89:C7:03:62:AD:9B:AE:4C:E2:DF:AF:2B:B8:FD:0F:B2:E3:14:B4:1A:33:64:99:3B:B3:2B:8F:B5:6A SHA-1: DE:03:4F:80:E6:69:4B:54:42:50:A6:1B:E0:B3:BA:9C:FE:A3:1D:23 (what Acrobat shows) Private key: Held offline, encrypted to my main PGP key. Download: https://keys.bensoyka.com/pki/root.crt Revocation: https://keys.bensoyka.com/pki/root.crl The one certificate to trust. It only certifies my own certificate authorities, its key is kept offline, and nothing below it can create further authorities. Trust it once and every document I sign will show as valid, including after I renew my signing certificate. [X.509 CA] My personal certificate authority Subject: Benjamin Soyka Personal CA Issuer: Benjamin Soyka Root CA Serial: 16685E103357FB7F8512FBF8DFD5FF3CE222C900 Valid: 2026-11-09 to 2036-11-09 SHA-256: 7A:42:74:CB:C0:BB:0D:AB:5F:CC:E4:9D:51:A6:18:36:E2:4D:73:70:15:9E:60:84:64:30:14:84:8B:67:57:4C SHA-1: C7:E9:9D:5C:62:BF:CF:48:E0:88:27:88:27:70:CE:BD:93:74:CB:01 (what Acrobat shows) Private key: Held offline, encrypted to my main PGP key. Download: https://keys.bensoyka.com/pki/personal-ca.crt Revocation: https://keys.bensoyka.com/pki/personal-ca.crl Sits under the root and issues the certificates I personally sign with. Its key is also kept offline. You don't need to trust it separately. [X.509] Document signing certificate Subject: Benjamin Soyka Issuer: Benjamin Soyka Personal CA Serial: 53A72E6DDC7792779150FBE316C9346DE6983ED6 Valid: 2026-11-09 to 2031-11-09 SHA-256: 3D:BE:D5:A3:FC:D4:17:8C:AD:FF:FE:A9:4C:97:D9:CB:8C:7A:D6:43:5A:15:56:6B:F0:88:9F:2A:17:EB:83:18 SHA-1: 73:67:FE:F2:3D:54:34:A6:C9:65:0E:67:60:CE:D6:23:FA:CC:BA:2A (what Acrobat shows) Private key: On a hardware security key only. It can't be copied off, so there is no backup; if the hardware is lost I issue a new certificate. Download: https://keys.bensoyka.com/pki/certs/docsign-primary.crt Attestation: https://keys.bensoyka.com/pki/attestation/docsign-primary-attest.crt via f9: https://keys.bensoyka.com/pki/attestation/docsign-primary-f9.crt What I sign PDFs with. Its private key was created on a hardware security key and can't be copied off it; the attestation file proves that, checkable against the hardware maker's own certificate authority. [X.509] Document signing certificate (backup) Subject: Benjamin Soyka Issuer: Benjamin Soyka Personal CA Serial: 191E9ABAADDF11E610CBC7DE2F167BD379DF0A4F Valid: 2026-11-09 to 2031-11-09 SHA-256: BF:B9:C5:37:09:42:5B:11:8E:4F:72:13:32:73:61:6E:F3:4A:74:1D:E4:E9:83:D7:EE:DA:42:2C:D5:6A:C5:8B SHA-1: 6B:70:9C:F4:17:1A:F0:B5:2E:C2:41:31:58:1B:34:E6:91:E1:1E:7D (what Acrobat shows) Private key: On a second hardware security key, kept somewhere safe. Can't be copied off. Download: https://keys.bensoyka.com/pki/certs/docsign-backup.crt Attestation: https://keys.bensoyka.com/pki/attestation/docsign-backup-attest.crt via f9: https://keys.bensoyka.com/pki/attestation/docsign-backup-f9.crt The same as above, on my backup hardware key, so I can still sign if the first one is lost. Signatures from either are equally mine. [KEYOXIDE] Keyoxide profile Identifier: aspe:keys.bensoyka.com:NGXUYTLMNMHQGGMPHUDLAWXOLY Profile: https://keyoxide.org/aspe:keys.bensoyka.com:NGXUYTLMNMHQGGMPHUDLAWXOLY Key: Ed25519, fingerprint NGXUYTLMNMHQGGMPHUDLAWXOLY Claims: openpgp4fpr:bc4876bdc8ab5ab8c9cb81659497e30583d68d89 dns:bensoyka.com?type=TXT dns:bsoyka.me?type=TXT https://gist.github.com/bsoyka/cba00e8777bcccad246129bcb2e7e15d Private key: Held offline, encrypted to my main PGP key. Download: https://keys.bensoyka.com/.well-known/aspe/id/NGXUYTLMNMHQGGMPHUDLAWXOLY Links my domains and accounts to my main PGP key. Keyoxide checks each link live, in both directions. [AGE] Backup encryption keys Key 1: age1pq1jvsuzdqqx86wjl0aanqsl8xzls255n42z0y92eu9z5z6vztz49yxntf5v3xrgs25jflmf76ex4tkeuht2zaesmkazk5hs3pcsp9tgjh5xs9hcjykmpcwese6cnvxvx7zfe2wcdcx5nz34q4840s9etge42a80vgjsjx368y7hvjzvdvpssr92hw9xynltakz9epzjzj4navekvz48sdulc7yzx542djcvq58s6fjdqwtdfkdcl242lwu9h2pvnv8y986awwpcmxv0axntu4xz2dsmgmzf237sndf6kc9d73vw09x8vayy53tkggkfwsyc47pj2ay79e2xd5dlyfz7x9p2pkgz7qqed6gs5cvwqq8kx74yktnxqk0fdzcwzydv23mrul9043y5fuaay0lx4ysa8x96kse2mpnz4t88swtwjcrfqzye7wy977atjs3v8pjtnywanvpqavf2cv6txy7ywqaeej39hk8ksz6485appxcwadzndkvz2ktyc4r8dzgt8j5dxurx6s7md6z7w64sggl2hn3lpqapmzn2yy90drhwfd6v0ck4pvtu7a6efenuksvd7rxkjzcfpttc9zfhlxg0e7xpu2wsu4swgkyy9k0ckdr5y7jyg5xgkpjewcs73s2vyevmd9e0cjdxkez6px2rvvsmu6fnrvtpyqm086e5y9evpy0pq6tepxppguud8au4q84t2avhyf32ncz2ef6ngj676t0n2qqdyuctnn2skmnqcq2gg8ud3q9hft6ny6zzg2rpfy68jq7qg56u54jfm3s8gqn3jvgkch8dvwxhvmx8ld5kg4avklvrgum2gr8hvssgr8u2k6hyuyuhv4ltgrf886yj49ke0llk5epvau9xkda623quv6y494prg094f6ng5thelpyraz5qs65y5wf0y7wupjh9mfc7zah5fpdszxq5ymgd9zh7d2kyvu6fucyvaaywertpfathtehqv89qcwtdtc7w6p5dp5ztptzyyarx5e3kxtljsfhp6guyf23x6a5fmuu2ufqj9883yespdguys5gpfmykhyg5txq9w55j9emuqtxf8cr9wc0g09845wy42395hwejcwrfv3azwghrktqpsg2pdv80kf9y7he2qk0tavxlr6favecwa5asty07tr0rq5a8z2s5pe3p99yc84vm2w9pf4eehac4ex5h4vy4nzsyrp8cakxya33yf7qk9kjcg0x3qszw5kz6hgk7g26xn30vpuava85rg4ehxve0555wpfdcae8w2x63uq7803vsyz5fcs5ja03ssm4xqq6dkujnpyskx85z4nrnw7y3ftz9h9umqy237y3kcz6u232qvyczdahqzmygfkcknafyq5xjatawyne8pdnk7pxyyhunww0w6ze55kpdjq6tvtkgy9lsylxcy467nu8s45h20q5dydw0w5jf4nr4tzrtzm30qa9xcva6v2gqksaapmzdmzuemvmyhgt9gnr3cnxjwxydh6vrdeqzjygh2wa05wpkaseuqeks9x9zazkf2kwfkpuknr2ww3ndlq9fgpf0ywgev6eggpn05g62hydxr0knsur0gpdx6e8wvpedqtu0qsauqeq9awyyjsxxcv3e2flkh9h5hx9e99vwmdv5jj22xx2wg2x8gpgny9ftlrgdanrzwc83n3mdvvae2rkl2r5lf5yjmnlzxtejqfvnja9x32633nzrgudkc8hg4l2jwgaqc5ek05jnmt0e3xt8qevkz5euyez7k78swlg4sjqmpr3vjzn4akgvt3m5hftj4mqgshf0um8r04j435fwyhd3tl6cgc9j0shr9zwy956kac3yyplae629khdj7kmdzyzpjn3kmxn6c7q6g9arl65d4xfup3ptt07zmsmvjtf2lljfxv28n3pgezfdnh54qm8f56z7eg4 Private key: Held offline, split into parts kept by different people. Key 2: age1pq1gtugz8xsqrhgyas5220cc956funpuaa6n6assr27m2nflg5du83m2mxxrv3qyk9egyskjzvyms6hquyngm3cgqyvg0pykc6ersdy4f29hcnxkm4j8ya4gujheec3zpp8jy9qgqun33mletyyrjdgddhpfsx629ntq9fleg3usysc0sqz8sxhfsua7gjwsps3xvnyc0xjf0xhccnvqa7fnq507nr4ex7pjjk2cejlxcnzle2jkymq63w5qcvv5n8a837xsxfeg95rmxmfg25vy6znv7tyc79pj8skyq2vh99uxmfywuejr6ty9aqgm4e2gnfvq4n0y3y69yzfxu32dcf9dr3dty8sz9zu0cshjlpshztvz0fqzq7cz2klqw3zf09hv0nm2yqzja9wdzklacxydlq88kvuvscthfq5c2swaytvew3y2dsh9qh0zct93zyfadzry3pp59gneu953nas234rfyygretsn5lewasmgkv2y0phnzds7kryccucv009jtfjmwulux5xlag3qn48xulrqggm3rqar53vxs6ee2ak4qq655jm7w8706u2y5emhd3yg9ts03rj3prpae6q4gnqqexj3cksppj7sj5yuv259snhml9rytsqy0tglv4z7kduhwq4f7042rfvejn3gqqgfwme74ex3xxkev8a590z0zqwnengda5qdvk4wy6jp3x6wwj0tykx0tmtrhx3q0cteqrdpx6vgyspxev8hr5txh5sq9e3nf9787apxfe4nk68vhmxngztu25emqa8c5ac90gtnugh5gdmy3amfp5r97df20kjpr48xt97ukjdxeuaxnnm6nsep95gwyz9kdzpge6c2wnx85wryjyt4vk9hrr673eu8kpzg8np52hm4w8k9pg3qfnc9mgje0e64xshk4zgr8rytztlrp484fwcgk3szpmjnvh3fz93h7tq52xj0ez7dywck5rr2ag0c8tnkx02n84wvwgrtj9a6dnl5qm905amcnq6f2jmpj95j2fdfeuct2h3y2n4svl8g9qu6zc4u7grkxysj2au08cqev3k0yqmy9f2u7rf0lv6p8msyzkc557900m6whfcwku5yvzp0xpkpd794vg98xt5q8trt86lqxeq7dcq6lr9x5g9dwc9pgd0tsrm695sa8mv69c5q7mnd855ewzr4trfy8arjj7e3fyp00ekezl932w8t0vszkky4a48j07dy2d6t95a2yzjzqpz258tj737nz5nrxewhf3kvpjhe62dgp9l5pk8kxnc0sz9l0f33tvt2hlhwg29zf6sckktlm0jgzm62ylsxu3zlavlnxpe7jkgxwz8gtgl6e5smxv79sag6kttrkll32eyyenklzgnqzqr524222wnrn5usuqz4wads9nen5j2rg2hwqpguyh0hqtkdlggs02jprvnqfkzdv7r8zp5tqgvf4sqzcv4vmnklj772vkvjx99z9gv8zmjvc700qxd8248spkrjwap3dp3clfyrfue8zmdukj9y7xpttgq98f73vfr4juwdgeu42vr80wqp0kmm3kx83qq8kxzaejfhu9wetg4rj8k2c3nq6evgcw3nfslqy4upp9dtz3uuz6k8z4mry809x07qekxmwy66nu44zf4fmpq80pjeyvt7ke80l7fwfa6ckzay8ruger4apkxu2dz9rdypqfgcdks9s2c9cz60254hwrgwkhkngskv3x7hyt5gcjzcpmfpcj4s66mrjnvmf9ey3e9ql5kq7apddqx8jqsh46ywhej6x2g84e4prk5jcf52hr9cxa34xacpdraq2l4lqecpftfk9aqhddnv9kdtt6vcvagrea5mxz5l5pzp3f5mjtfza448z4lknnyxthaxvt4kx7zxsw2yxprqwl4pdtkqt0j277x7ph6amyffgxfgre8 Private key: Held offline. Key 3: age1pq1cn6quhpuhez7hvwty39lnx5j88yxpfsefku3vefvx23l5lxxerncqw8ytgpuszfutzg902qpgxt8344vxeztshahmjgf4rqms5ztjnzrpzmr4wdp0f2yr463njjhtrautc675g3vmvgjd9ads3j3aycmqj27x0v9ny85v7p9avfydykreslk8pytf3gjswgdkq39c3lgq7vlxvuvvxev3cszxqsz4fw4gmuqscjx564amcjgfscrh8gey593wxjtn3nynxztszwqs3grqkdwtgumu0xjrk6vg5zenxcc324ug6lckxsahcxr6xn636ytf8hahpruga6upur7hzffss22v0uay6v36fkmpwyhtle2cvzhg6lx24hwkgh5afy9uj5jwnq3nttydw34ly02jemtuvtrvsd9vew9h3evx3x9fzp070zrf42343dpyfd32c47mys78e586tp4yuxrcjqmyf9w0ay7jsqsycj4g68qya2f3qs8tg9v99625md34z8pvz39h9j5vd9zpc9uyrpzqw3kcpsnhjwnnz4g79eh8wex0ml8z3ycxpkkdcguahc6avmvsgl6w9da0w2x0xfyp99c3qhu39xqj6qg4jd533v4647f6wu5j9nkq2wxl99ddf6p2gr6zlj6vxwf09zym2t9j4qf5qu9scy6ypnfxsxf9d0fzsgmq52pr3u9sxd4jhcx4f0auasupa2m6nepr734vauju2spg7r55kvnsnwx3uzejn556pwlqyq5pucnwz93ysjax6cjes3x845pdjueq6sepf96xvh7qap6uaf09ljf0fxxygng2xrwspex76aevlpq227n8hvy28ua6dplenrs8ju8gpq68uuq2rfcja55uvnq8qqglvk39vpr2k2wsve5cxv7w3fmcw0j94qgjkaktq9rwurrwysssuq3vex2yszcqyzkwgywxagv75sepmkc2r8832pk9sex3v2979gu2np65z25qw3lzxe0alnzpkphvrzrczrkxzln2q6e5e2uf7ugkzpz5z88sx4kgzuesrgkmd8xy2txsthj3ft3q7dv9gzjauludychx72v2qg0mey8w65ge6exdqn00z0l8xwf2wqnrkqhrw5rhswvtpkuyy8mfw9w9az8s93hhasyzzrn5trkrvuemd59d0tes78prgmu8v2sw65shkgzswqt9yqlh008y66n8sdenxmvqrfp9sr7ywdt5fxgmk2yug9z2fwx2p59gdaymyn6uwakr4fqehhkqyhszhz02a2dqd204tgcpat452alzl6vc0z9p7dsu0j9g0r6ccckgpsu5zmlf9q09d5uc8293zd32r0hw5jry7e4lxce05zfv9ed4zpxjq6yzf6ye6t8yngsf495h35hjr9h3qqsk97fls0tzvpyzrhpq4xwkj4w5kq2t8r5qkmy3rj3tx2wxaag27y2qxy620424g8v5yrg59vsv6eh0m78e2ptp2kyj0rrss95pjv2xdp9v92ajzzkm0rgfxzs6rj4775xgnnjyv7877v5lk3689rs658rtzhpk3dv03xy53gj4mrq8dncsjjjrx43g7rw69s9cjjz092tkjlpchvq5fdlzap49myfqu9q3vc32vcj5uf85ps7wndjqj5rpv2jr8hhnsue4nqrw9w996gc5t4r4ramegcrqusaltwfrwcut9spr88rny63mz23r52f3ypqxmmlq7l80znd53ue89p288q6tvcrv7045aq55et0rjn46uspskrypzhqgs8k62zcfqnk824qg63pk3aeqamnx3cqwmnf50ctdnpvppm7wf7tg9l49525gxfsm4wv4dsctljhxlm64jq3as93upwmhfpz25885guy0q4pmu6ugld7lwec2w4a8gv9kds45mnaudxll6xkmhw2na7mpqzynkgk Private key: Held in my password manager. Download: https://keys.bensoyka.com/age/backups.txt My backups are encrypted to these three age keys before they leave my computer; any one of them can decrypt. They're listed so you can tell they're mine, not because anyone else needs to encrypt to them. ====================================================================== RETIRED OR REVOKED (history only; don't encrypt to or newly trust) ====================================================================== [PGP] Previous PGP key (2021-2026) Fingerprint: 0CA7 CC16 A64B 68F3 048E E8FE A5E7 26D5 A652 28EA Type: rsa3072, created 2021-01-24 (revoked 2026-08-21) UID: Benjamin Soyka [revoked] UID: Benjamin Soyka [revoked] UID: Benjamin Soyka [revoked] UID: Benjamin Soyka [revoked] UID: Benjamin Soyka [revoked] UID: Benjamin Soyka [revoked] Subkey: EB2968D0F1DD9B0CB9767E907BED20103FBB4DB5 Encrypt, rsa3072 Certified: Main PGP key, 2026-08-21, on hello@bsoyka.me, Benjamin Soyka, bensoyka6@gmail.com, soyka006@umn.edu Private key: Held offline, encrypted to my main key, only to decrypt old messages. Download: https://keys.bensoyka.com/pgp/0CA7CC16A64B68F3048EE8FEA5E726D5A65228EA.asc Replaced on 2026-08-21 as routine maintenance, not because anything went wrong. Signatures it made before then are still genuine. Don't encrypt to it. [PGP] Original PGP key (2020-2025) Fingerprint: 91FA 6964 6625 ECAB 5DE4 A697 3779 9464 147A 3418 Type: rsa2048, created 2020-06-15, expires 2022-06-15 (revoked 2025-07-19) UID: Benjamin Soyka [revoked] Subkey: 287579F9963C99D75B1DF38B20A81F2E9E522C59 Encrypt, rsa2048, expires 2022-06-15 Private key: Held offline, passphrase-protected, only to decrypt old messages. Download: https://keys.bensoyka.com/pgp/91FA69646625ECAB5DE4A69737799464147A3418.asc Revoked 2025-07-19. Listed for completeness. [X.509] Earlier signing certificate (Aug–Nov 2026) Subject: CN=Benjamin Soyka Serial: EE36815AD966D5FE Valid: 2026-08-24 to 2036-08-21 SHA-256: 05:6C:87:36:8D:AA:9A:FE:78:63:29:0C:0C:D2:4E:84:A4:62:13:83:D7:EA:31:5D:AF:00:95:52:95:E7:32:BA SHA-1: E9:7B:60:49:4F:0C:BE:1C:71:10:CF:C4:BF:F2:5C:9F:54:A1:7D:40 (what Acrobat shows) Private key: Was on a hardware security key, but a software copy existed and was shared outside my control on 2026-11-09. Removed from the hardware and all copies deleted. Download: https://keys.bensoyka.com/pki/retired/2026-08-24-p256-signing.crt Used to sign documents from August to November 2026, with its key stored on hardware. A software copy of the key existed and was shared outside my control on 2026-11-09, so it's retired as of then. Documents I sent before that are genuine; if in doubt, ask me. ====================================================================== LEGACY ====================================================================== [LEGACY] Keybase Private key: Keybase's own device keys, not part of this setup. My old Keybase proof stays up so existing checks don't break, but Keybase isn't maintained anymore. My accounts are now linked to my key on Keyoxide. -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQTHuCbThVWvo65/ohbyAej6LXITnwUCavJCMgAKCRDyAej6LXIT n+JwAQCXVsE7jPexmc/qBsQjn/mcHMNvU0PXWp5vmW2h9br1uwEAuNZhp325h2xo lGGes17Br8gb8hkySPX0oiAaZ5O3dQs= =/XPo -----END PGP SIGNATURE-----