From b2672d1df092ddb8513e878de574acbb95e4f3bb Mon Sep 17 00:00:00 2001 From: inference Date: Tue, 24 Jun 2025 16:12:29 +0000 Subject: [PATCH] feat(key): add SSH-key verification instructions --- key.xhtml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/key.xhtml b/key.xhtml index 8e1f612..24c29a5 100644 --- a/key.xhtml +++ b/key.xhtml @@ -1,7 +1,7 @@ - + @@ -107,7 +107,10 @@

SSH keys used to sign data outside of their validity periods should be classified as compromised; only trust SSH keys used within their validity periods.

Each SSH key is signed with the previous key, allowing verification of the - chain-of-trust.

+ chain-of-trust. It is strongly recommended that you verify the entire + chain, which can be performed by adding each of my public keys to SSH's + allowed_signers file, then running the following command for each key:

+ 
ssh-keygen -Y verify -f <allowed_signers file> -I <signer name/email address> -n file -s <signature file of file-to-verify> < <file-to-verify>
ID