# The release signing key

The public half of the release signing key, an Ed25519 key generated on 11 October 2026 on the founder's own machine
(fingerprint SHA256:umhm59z0pvL2OCPwi0zl1VcRCr4poHILz9zbzWEGCLk). The private half never leaves that machine and is
never on a box, in a repository or in a message. Every release's SHA256SUMS is signed with it by one command on
that machine; the site and verify.sh check the signature against this file.

Sign (on the key's machine, in the directory holding the release's SHA256SUMS):

    ssh-keygen -Y sign -f ~/.config/igneum/release-signing -n igneum-release SHA256SUMS

Verify (anywhere, with this directory's allowed_signers):

    ssh-keygen -Y verify -f allowed_signers -I igneum-release -n igneum-release -s SHA256SUMS.sig < SHA256SUMS

The namespace is igneum-release; a signature made under another namespace does not verify. A release published
before its signature exists says "unsigned candidate; sha256 published" on its page until the signature is beside it.