-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

OpenPGP key transition statement
Joey Innes — rmrf.uk — 2026-08-05

I am replacing every OpenPGP key previously associated with me. From today,
the only key I use is:

  NEW    72CA C43C 1443 2391 48AC  E94E F9B0 1230 6931 F45A
         Joey Innes rmrf.uk
         ed25519, published at https://rmrf.uk/pgp.txt

  The user ID carries no email address, deliberately, as the key it replaces
  before last did not. The way to reach me is on https://rmrf.uk — the key
  says who I am, not where to send things.

Two keys are retired.

  RETIRED  7D9F B387 48B5 6BB0 F6EF  6DB2 CC29 883C 133B D7E1
           Joey Innes <joey@inneslabs.uk>
           ed25519, created 2024-04-24

  This key is sound, but its user ID claims an address at inneslabs.uk, a
  domain I no longer control. I am not willing to keep asserting an identity
  I cannot back, so it is retired and revoked rather than merely re-worded.
  This statement is signed by it, so anyone holding it can verify the change.

  ABANDONED  BA93 CD1F 4807 8187 6548 0C7A ADEE 4FEE A744 A090
             uid "fjag", dsa3072, created 2024-05-28, expired 2026-01-01

  This is the key rmrf.uk published until today. It expired on 2026-01-01 and
  I no longer hold its secret key, so I cannot sign this statement with it and
  no signed rotation from it is possible. Treat it as dead: do not encrypt to
  it, and do not trust any signature it makes from now on, since a signature
  from it would mean someone other than me holds the secret. Signatures it
  made before 2026-01-01 were mine, but I cannot prove that here.

  Because that key cannot sign, the claim about it rests on this document
  reaching you over HTTPS from rmrf.uk, a domain I do control — not on
  cryptography. That is a real difference and it is stated rather than hidden.

The transition itself, from 7D9FB387 to the new key, IS cryptographically
verifiable: this document is clear-signed by both.

  gpg --fetch-keys https://rmrf.uk/pgp.txt
  gpg --verify pgp-transition.txt
-----BEGIN PGP SIGNATURE-----

iJEEARYKADkWIQT2hjdXHs8Y7I15xwJy/M3WMBVRaAUCanOkNRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQcvzN1jAVUWiNtwD/U6Nr4P2B2weU0dUvpUq+
PJpuO0gvt4rKgj5o0JGzSpQA/1OadR/SOREJevVKpU2wPCwECJSrZp96RV1F1dkG
A9ICiJEEARYKADkWIQSrfZpToLhxgxd6BI1T3YtZffxlbgUCanOkNRsUgAAAAAAE
AA5tYW51MiwyLjUrMS4xMiwwLDMACgkQU92LWX38ZW6yXwEAgwcl1zK9xHu9mOCp
lgKOpLJaZULPmQN+5vEou77a7bABAKN5Wh8b1ZQ5ZkrCULYTphLqc18HOPBnRqdD
sYhSiQoG
=42OK
-----END PGP SIGNATURE-----