OpenPGP Web Key Directory (WKD)

This repository hosts the OpenPGP Web Key Directory (WKD) for stuermer.pro.

WKD allows OpenPGP clients such as GnuPG to automatically discover the public key for:

benjamin@stuermer.pro

The key is published using the advanced WKD method:

https://openpgpkey.stuermer.pro/.well-known/openpgpkey/stuermer.pro/hu/<hash>

.
├── .nojekyll
├── CNAME
└── .well-known
    └── openpgpkey
        └── stuermer.pro
            └── hu
                └── 9ar5amz1qp7drs83xdtgrjshzmy586ke

The file inside hu/ is the binary OpenPGP public key. It must not be ASCII-armored.

Generate/update it with:

gpg --export 121AA72AB89DCDC2FEEAA5CD2525AE02D55B53E9 \
  > .well-known/openpgpkey/stuermer.pro/hu/9ar5amz1qp7drs83xdtgrjshzmy586ke

curl -v \
https://openpgpkey.stuermer.pro/.well-known/openpgpkey/stuermer.pro/hu/9ar5amz1qp7drs83xdtgrjshzmy586ke \
-o /tmp/wkd-key

Expected:

HTTP/2 200
content-type: application/octet-stream

Verify the key:

gpg --show-keys /tmp/wkd-key

Use a clean GnuPG home to avoid cached keys:

mkdir /tmp/gpg-wkd-test

GNUPGHOME=/tmp/gpg-wkd-test \
gpg --auto-key-locate clear,wkd \
    --locate-keys benjamin@stuermer.pro

For debugging:

GNUPGHOME=/tmp/gpg-wkd-test \
gpg --debug ipc \
    --auto-key-locate clear,wkd \
    --locate-keys benjamin@stuermer.pro

A successful lookup should show the key being retrieved via:

https://openpgpkey.stuermer.pro

The subdomain must point to GitHub Pages:

Type    Name          Value
CNAME   openpgpkey    <github-pages-hostname>

The GitHub Pages custom domain must be configured as:

openpgpkey.stuermer.pro

This ensures GitHub provisions a valid TLS certificate for the WKD endpoint.

• The WKD endpoint serves only the public key.
• The private key and signing material remain offline.
• The primary OpenPGP key is not hosted here; only the exported public key is published.