Shooting myself in the foot when I feel like it should be the face

You ran into the classic keys aren’t identities problem. Super easy to miss when you’re deep in the build.

Separating account ID from PGP keys is the right move. It just sucks because now you’re paying the cleanup cost all at once.

what if you encrypt a fingerprint of the new pgp key using the old pgp key, making the system connect the 2 fingerprints to 1 acc?

as always keys arent proof of identity theyre proof of key ownership.congratulations on coming up with a way around that limitation,software engineering can suck but feels good to design a fix

Oh it is. A complete headache I was not too happy to find out and need to fix.

The way it works is we have a identical canonical text like

Test4PayKeyRotation__v1__<oldPGPKEY>__<newPGPKEY>__<DATETIME>

which gets signed individually by both PGP keys. It is saved in a table and synced between the different core repos to tie the fingerprints together into one account.

ok, sounds good, just make sure it can scale :)

will there be only 1 active pgp pub key per acc? if not will all of the previous pgp keys will need to be checked over and over?

even here who ever has the key has the control, so its the same exact thing, if someone can steal your key, someone can steal it and upload another one.

but although pgp isn't a proof of identity, its one of the best closest things to it.

Only one active. New submissions from that user need to use the latest PGP key. Old PGP keys that have been rotated can't be used again. History doesn't need to change. It's just PGP key stuff.

got ya,, sounds good

What about not allowing public key that expires?