# Digital Empire responsible-disclosure PGP key.
#
# STATUS: not-yet-published (Andy tap pending 2026-08-21).
#
# Why this is a placeholder and not a real key:
#   Publishing a fabricated PGP public key would be actively worse than
#   publishing nothing. Any researcher who encrypted a sensitive report
#   to a key we don't hold the private half of would produce ciphertext
#   we literally cannot read -- a silent-drop failure mode we refuse to
#   ship.
#
# What you can do right now:
#   1. Email hello@citationsafe.com in plaintext. Our
#      /security-disclosure policy §6 explicitly permits plaintext
#      disclosure -- PGP is optional, not required.
#   2. Or submit via the web form at /security-disclosure (TLS 1.3, HSTS
#      preloaded, per-request nonce-based CSP).
#   3. Or open a private GitHub Security Advisory at
#      https://github.com/andrewjgaber-commits/empire-distribution/security/advisories/new
#      (visible only to Digital Empire maintainers + you).
#
# When the real key is published:
#   Fingerprint will be printed at the top of this file. RFC 9116
#   §2.5.4 says the Encryption field MAY point to any published key
#   (WKD, HKP keyserver, or a URL like this one); this URL is the
#   canonical source-of-truth per our /.well-known/security.txt.
#
# ANDY TAP to publish real key:
#   gpg --full-generate-key            # RSA 4096, 1-year expiry
#   gpg --armor --export hello@citationsafe.com > pgp-key.asc
#   Then set env var SECURITY_PGP_PUBLIC_KEY_ASCII to the file contents
#   in Vercel dashboard (Project -> Settings -> Environment Variables).
#   This route auto-serves the real key on next deploy; no code change.
#
# Contact: mailto:hello@citationsafe.com
# Policy:  https://digital-empire-app.vercel.app/security-disclosure