New Blog: #Keyserver Updates and Roadmap, December 2025

...

About half of the public #Hockeypuck keyservers have been upgraded to the 2.3 branch (as of 2025-12-08), including the pgpkeys.eu servers. A small number remain on 2.1 for compatibility reasons, but the remaining issues preventing upgrade of these 2.1 servers will be addressed in an upcoming 2.3.x release.

...

While HKPv2 and RFC9580 support are the current priorities, further improvements are planned for delivery in 2026 and 2027. These include:

* Allowing #OpenPGP key owners to explicitly restrict the distribution of third-party signatures over their User IDs, to prevent signature flooding.
* Out of band email proofs of User ID validity, to mitigate spam and impersonation.
* A fully-featured management API to better handle deletion and blocklisting of incorrect or spammy keys.
* Native rate limiting and tor exit node abuse detection.
* Detection (and potential removal) of keys with known vulnerabilities or weaknesses.
* Improvements to the dump and restore process to allow a running server to be backed up without a restart.

https://blog.pgpkeys.eu/keyserver-roadmap-2025-12.html

#infosec #cryptography #pgp

New Blog: #Keyserver Updates and Roadmap, December 2025

...

About half of the public #Hockeypuck keyservers have been upgraded to the 2.3 branch (as of 2025-12-08), including the pgpkeys.eu servers. A small number remain on 2.1 for compatibility reasons, but the remaining issues preventing upgrade of these 2.1 servers will be addressed in an upcoming 2.3.x release.

...

While HKPv2 and RFC9580 support are the current priorities, further improvements are planned for delivery in 2026 and 2027. These include:

* Allowing #OpenPGP key owners to explicitly restrict the distribution of third-party signatures over their User IDs, to prevent signature flooding.
* Out of band email proofs of User ID validity, to mitigate spam and impersonation.
* A fully-featured management API to better handle deletion and blocklisting of incorrect or spammy keys.
* Native rate limiting and tor exit node abuse detection.
* Detection (and potential removal) of keys with known vulnerabilities or weaknesses.
* Improvements to the dump and restore process to allow a running server to be backed up without a restart.

https://blog.pgpkeys.eu/keyserver-roadmap-2025-12.html

#infosec #cryptography #pgp

We are pleased to announce the release of Hockeypuck 2.3.

Hockeypuck 2.3 is primarily a technical-debt release, but also adds features to ease the upgrade process in a production environment:

* Updates to the PostgreSQL table schemas
* Offline, in-place reload of all key material
* Online reindexing of table schemas
* PKS support

There are no breaking changes between the 2.2 and 2.3 branches, and SKS sync is supported between 2.2 and 2.3 peers.

Release notes can be found at https://github.com/hockeypuck/hockeypuck/releases/tag/2.3

Hockeypuck 2.3 development is kindly supported by @NGIZero Core

----

Hockeypuck is a modern synchronising #OpenPGP #keyserver that is optimised for ease of deployment, particularly in containerised environments via docker-compose.

https://hockeypuck.io
https://github.com/hockeypuck/hockeypuck

We are pleased to announce the release of Hockeypuck 2.3.

Hockeypuck 2.3 is primarily a technical-debt release, but also adds features to ease the upgrade process in a production environment:

* Updates to the PostgreSQL table schemas
* Offline, in-place reload of all key material
* Online reindexing of table schemas
* PKS support

There are no breaking changes between the 2.2 and 2.3 branches, and SKS sync is supported between 2.2 and 2.3 peers.

Release notes can be found at https://github.com/hockeypuck/hockeypuck/releases/tag/2.3

Hockeypuck 2.3 development is kindly supported by @NGIZero Core

----

Hockeypuck is a modern synchronising #OpenPGP #keyserver that is optimised for ease of deployment, particularly in containerised environments via docker-compose.

https://hockeypuck.io
https://github.com/hockeypuck/hockeypuck

News from the coalface!

The pgpkeys.eu test swarm is now running an alpha version of #hockeypuck 2.3, and is gradually reindexing itself to populate the new SQL table structure required for RFC9580 and PQC support.

The PostgreSQL storage layer has been extensively refactored and improved. It now supports background reindexing during normal operation, and in-place reloading of the database without dumping to disk. Previously, reindexing and reloading were only possible by dumping, deleting the database, and reloading the dump from scratch, which was an error-prone manual process - in v2.3 reloading will be a single command, and reindexing happens automagically. 🤩

Old-school PKS sync has also been implemented natively, to enable (less efficient, more robust) sync between different versions of Hockeypuck, or even with non-SKS keyservers such as Hagrid 😈.

These changes will make it much easier for #keyserver operators to upgrade to newer versions of hockeypuck, and increase the reliability of the synchronising keyserver network.

Watch this space for more news, particularly about the upcoming support for PQC algorithms in #openpgp!

(Hockeypuck 2.3 development is generously supported by @NGIZero)

News from the coalface!

The pgpkeys.eu test swarm is now running an alpha version of #hockeypuck 2.3, and is gradually reindexing itself to populate the new SQL table structure required for RFC9580 and PQC support.

The PostgreSQL storage layer has been extensively refactored and improved. It now supports background reindexing during normal operation, and in-place reloading of the database without dumping to disk. Previously, reindexing and reloading were only possible by dumping, deleting the database, and reloading the dump from scratch, which was an error-prone manual process - in v2.3 reloading will be a single command, and reindexing happens automagically. 🤩

Old-school PKS sync has also been implemented natively, to enable (less efficient, more robust) sync between different versions of Hockeypuck, or even with non-SKS keyservers such as Hagrid 😈.

These changes will make it much easier for #keyserver operators to upgrade to newer versions of hockeypuck, and increase the reliability of the synchronising keyserver network.

Watch this space for more news, particularly about the upcoming support for PQC algorithms in #openpgp!

(Hockeypuck 2.3 development is generously supported by @NGIZero)

@hardtech @revengeday @Tutanota Just as a FYI, note that @Tutanota doesn't actually offer standard encrypted emails ( #OpenPGP, #GPG or #PGP which has been used for decades): https://tuta.com/encryption

You of course don't notice this if you only send emails between Tuta users, but if you try to send an encrypted email externally, well then the whole thing breaks down and you end up having to arrange a secure way of sending a password to the recipient: https://tuta.com/support#encrypted-emails-external

P… mais ! en plus d'être valide SPF/DKIM/DMARC/ARC les spammeurs signent leurs messages avec #OpenPGP !
#spam #mail

X-Spamd-Result: …
SIGNED_PGP(-2.00)[];
ARC_ALLOW(-1.00)[xxx.xxx:s=dkim:i=1];
DMARC_POLICY_ALLOW(-0.50)[xxx.xxx,quarantine];
R_SPF_ALLOW(-0.20)[+mx];
R_DKIM_ALLOW(-0.20)[xxx.xxx:s=dkim];
MIME_GOOD(-0.20)[multipart/signed,multipart/mixed,text/plain];

P… mais ! en plus d'être valide SPF/DKIM/DMARC/ARC les spammeurs signent leurs messages avec #OpenPGP !
#spam #mail

X-Spamd-Result: …
SIGNED_PGP(-2.00)[];
ARC_ALLOW(-1.00)[xxx.xxx:s=dkim:i=1];
DMARC_POLICY_ALLOW(-0.50)[xxx.xxx,quarantine];
R_SPF_ALLOW(-0.20)[+mx];
R_DKIM_ALLOW(-0.20)[xxx.xxx:s=dkim];
MIME_GOOD(-0.20)[multipart/signed,multipart/mixed,text/plain];

🔐 Every unencrypted email is readable by 10+ entities and stored forever.

Web Key Directory (WKD) changes this: automatic encryption using your domain name. No manual keys. No central servers. Just cryptographic certainty.

WKD makes encrypted email as simple as HTTPS made web browsing secure.

https://www.nicfab.eu/en/posts/wkd2/

#WebKeyDirectory #WKD #EmailEncryption #Privacy #InfoSec #Cryptography #OpenPGP

WKD-Java provides an API and CLI for querying #OpenPGP keys from the WebKeyDirectory.

Release 0.1.3 depends on PGPainless 2.0.0, cert-d-java 0.2.3 and cert-d-pgpainless 0.2.3.

https://codeberg.org/PGPainless/wkd-java

I just released #PGPainless 2.0!

The new release comes with support for #OpenPGP v6 ( #rfc9580) leveraging #BouncyCastle|s new high-level OpenPGP API internally.

The API saw substantial changes compared to the 1.7 release line. Among others, it migrated away from the singleton pattern towards configurable API instances.

You can download the (Linux_x86_64) native CLI binary binary here: https://github.com/pgpainless/pgpainless/releases/tag/2.0.0

🔐 Every unencrypted email is readable by 10+ entities and stored forever.

Web Key Directory (WKD) changes this: automatic encryption using your domain name. No manual keys. No central servers. Just cryptographic certainty.

WKD makes encrypted email as simple as HTTPS made web browsing secure.

https://www.nicfab.eu/en/posts/wkd2/

#WebKeyDirectory #WKD #EmailEncryption #Privacy #InfoSec #Cryptography #OpenPGP

RPM 6.0 released with support for RPM v4 and v6 packages, support for multiple OpenPGP signatures per package, support for OpenPGP v6 and PQC keys and signatures, enforced signature checking, various rpmkeys enhancements

https://rpm.org/releases/6.0.0

#rpm #packagemanager #linux #linuxpackaging #openpgp #freesoftware

I just released #PGPainless 2.0!

The new release comes with support for #OpenPGP v6 ( #rfc9580) leveraging #BouncyCastle|s new high-level OpenPGP API internally.

The API saw substantial changes compared to the 1.7 release line. Among others, it migrated away from the singleton pattern towards configurable API instances.

You can download the (Linux_x86_64) native CLI binary binary here: https://github.com/pgpainless/pgpainless/releases/tag/2.0.0

RPM 6.0 released with support for RPM v4 and v6 packages, support for multiple OpenPGP signatures per package, support for OpenPGP v6 and PQC keys and signatures, enforced signature checking, various rpmkeys enhancements

https://rpm.org/releases/6.0.0

#rpm #packagemanager #linux #linuxpackaging #openpgp #freesoftware

Einblicke in das #Datenspuren-Programm

Heute: Irgendwas mit Nitrokeys - #Workshop und Keysign-Party

https://talks.datenspuren.de/ds25/talk/W3JBDH/

In ihrem Workshop betreut @span senf Menschen beim Einrichten von Nitrokeys und danach kann gegenseitig mit den #OpenPGP-Schlüsseln signiert werden.

Wann? 20. September, 15:15 bis 17:00 Uhr
Wo? Kleiner Saal

Komplettes Programm ansehen: https://talks.datenspuren.de/ds25/schedule/

P.S.: Die Nitrokeys sollten im Vorfeld bei Nitrokey beschafft werden (ca. 55€).

#Datenspuren2025#Datenspuren25

Einblicke in das #Datenspuren-Programm

Heute: Irgendwas mit Nitrokeys - #Workshop und Keysign-Party

https://talks.datenspuren.de/ds25/talk/W3JBDH/

In ihrem Workshop betreut @span senf Menschen beim Einrichten von Nitrokeys und danach kann gegenseitig mit den #OpenPGP-Schlüsseln signiert werden.

Wann? 20. September, 15:15 bis 17:00 Uhr
Wo? Kleiner Saal

Komplettes Programm ansehen: https://talks.datenspuren.de/ds25/schedule/

P.S.: Die Nitrokeys sollten im Vorfeld bei Nitrokey beschafft werden (ca. 55€).

#Datenspuren2025#Datenspuren25

Any software that needs to encrypt data using OpenPGP, or to verify an OpenPGP signature on data, should use the stateless OpenPGP interface, or SOP, which is provided for a number of OpenPGP implementations. Using any other interface is going to lock in the software to that implementation.

Also, SOP is lovely to use from another program. It's designed to be nice to use from a program.

https://openpgp.foo/learn/sop/

#OpenPGP#SOP#StatelessOpenPGP

Any software that needs to encrypt data using OpenPGP, or to verify an OpenPGP signature on data, should use the stateless OpenPGP interface, or SOP, which is provided for a number of OpenPGP implementations. Using any other interface is going to lock in the software to that implementation.

Also, SOP is lovely to use from another program. It's designed to be nice to use from a program.

https://openpgp.foo/learn/sop/

#OpenPGP#SOP#StatelessOpenPGP