Guides

A guide walks through one procedure step by step, with the result of each step and a drill on test keys. The guides say how; the pages under Learn say why and when, so read the matching Learn page first if a step is not clear.

Guide	When	Learn first
Adopting the roots	Once, at the start: the real roots on two cards, and the drill that comes first.	The life of a root
Re-sign every year	Every year: the same keys, a new validity.	Re-sign
Rotate a key	On an event, or after at most three years.	Rotate
Revoke a key	A key is compromised, or retired for good.	Revoke
A lost root card	A root card is lost, stolen or compromised. This is the recovery guide.	Recover
Back up and restore	After every change, and as a drill once a year.	The ledger

Using OpenPGP in practice

Your daily subkeys, put to work. Each of these uses the tools you have today; creating the keys with ritueel is planned.

Guide	When	Learn first
An authentication subkey for SSH	You want to log in to servers with a key on a card.	OpenPGP custody chain
Sign git commits and tags	You want commits and tags shown as verified.	OpenPGP custody chain
Sign software and releases	You publish downloads that users should be able to verify.	OpenPGP release keys
OpenPGP or Sigstore	You are choosing how to sign, or want both.	Custody chains compared

More guides follow, one for each transition between key stores (issue #19). The drills are tracked in issue #20.