Learn
ritueel teaches first. These pages explain how roots and intermediates are handled securely, whatever tool you use; the tools exist to make the rituals simpler, and they come after. Read the pages in order. Each one assumes the page before it.
| Page | What you learn |
|---|---|
| What is a root? | The key that everything else hangs from, and what goes wrong when it is lost or stolen. |
| Root and intermediate | The two kinds of key in a chain of trust, and the same split in OpenPGP: the master key and its subkeys. |
| Why the root stays offline | What “offline” protects against, and how much of it you can have without a vault and a live CD. |
| What a ceremony is | The rare, manual use of a root, why it is manual, and why that is a feature. |
| Layered trust | Why trust comes in layers, what each layer is for, and where redundancy helps and where it does not. |
| The custody chain | Who or what holds each key from the root to the leaf, and what a verifier really trusts. |
| Custody chains compared | Public PKI, private PKI, OpenPGP and SSH side by side: who holds what, what you control, how revocation works. |
| Where a key lives | Software and its backends, YubiKey PIV and OpenPGP card, AWS KMS and the planned stores, compared in the open. |
| Which keys to buy | The hardware worth buying to learn and test, what each can and cannot do, and prices with their dates. |
| The ledger | The record of what you did: where it lives, how it is backed up, and how it is restored. |
| The life of a root | Create, sign, record, back up, re-sign, rotate, revoke, recover: the whole story in order. |
| Re-sign, rotate, revoke, recover | One page for each ritual: why, when, and what can go wrong. |
| Moving from one root to another | How a new root takes over from an old one without breaking anyone, and what outsiders install. |
| Two roots in practice | What public CAs do, how clients behave when an intermediate has two certificates, and how two cards alternate. |
| OpenPGP release keys and the keyring | The primaries, an intermediate’s subkey, the back-signature, the keyring package, and what a revocation reaches. |
When you are ready to act, the guides give the steps. The principles are the rules ritueel’s design follows, and the decision records hold the reasons.