SSH keys used to sign data outside of their validity periods should be classified as compromised; only trust SSH keys used within their validity periods.
Each SSH key is signed with the previous key, allowing verification of the - chain-of-trust.
+ chain-of-trust. It is strongly recommended that you verify the entire + chain, which can be performed by adding each of my public keys to SSH's +allowed_signers file, then running the following command for each key:
+ ssh-keygen -Y verify -f <allowed_signers file> -I <signer name/email address> -n file -s <signature file of file-to-verify> < <file-to-verify>
| ID |
|---|