PGP Public Key

Current key

How to verify this key

You should verify the key before trusting it. Four independent channels to cross-check the fingerprint 62B7 9979 C97C 1241:

1. This page, fetched over HTTPS with a valid TLS certificate from Let's Encrypt.
2. DNS — _openpgpkey.cryptoservers.io TXT record lists the same fingerprint.
3. Keybase — keybase.io/cryptoservers (cross-signed on Twitter/Mastodon).
4. Keyservers — keys.openpgp.org, keyserver.ubuntu.com, pgp.mit.edu.

If any of the four disagree with the fingerprint on this page, do not use the key and email [email protected] with the discrepancy.

What we sign with this key

• Weekly warrant canary — /canary.
• Support correspondence on sensitive matters (abuse, legal, billing disputes).
• Release announcements for the official cs CLI and the Terraform provider.
• Invoice receipts on request.
• Transparency Report publication (semi-annual).

Automated system emails (password reset, usage alerts) are not PGP-signed. Do not assume an unsigned automated email is authoritative — cross-check via the panel.

Key rotation

We rotate the primary key every three years, with overlap: the new key is published six months before expiry, cross-signed by the outgoing key, and the transition is announced on this page, in the canary, and via email to account holders with PGP public keys on file.

If the key is compromised or suspected compromised, a revocation certificate is published immediately on this page, to the keyservers listed above, and via the next canary release. We keep the pre-signed revocation certificate offline, split via Shamir secret-sharing across the Saint Kitts company secretary and two non-operational officers.

Sending us a signed or encrypted message

For sensitive matters (abuse reports involving identifiable individuals, legal notices, security-research disclosures, sensitive billing queries) we recommend PGP-encrypted and/or signed mail.

If you do not have a PGP key of your own and still want to reach us over an end-to-end-encrypted channel, mention it in a plain email to [email protected] and we will set up an ephemeral Signal or Element room for the exchange.