did:repo. This repository starts with a signed, empty inception commit, and its hash is the repository's identifier, did:repo:fb7bebb45813df8d78c6bd950d9402d8272b1d13. It never changes, even as the keys that sign the repository change.

XID. My XID is derived from the same key that signed the inception commit, so one key fixes both identifiers: c787c8599f3e22a5c6ef3e6ae22bd85e667333cc85d8359f3faa31065b975642. See xid.md for the key and the derivation.

Signing keys. The second commit sets who may sign what, in the files under .repo/config/verification/:

• cold-root, offline: recovery, policy, main, commit
  SHA256:TNK7EPumfe+U9/d/Pma2VQ0fXrK4eZupYsqpRk9UFYE
• yubikey-policy, YubiKey, touch and PIN: policy, commit
  SHA256:B2XSEQ/unKmBX76OfL73a+83h7inA4yZAM8Y66f9g3A
• yubikey, YubiKey, touch: main, commit
  SHA256:ZpU4/LVyejMIK98wXbfjYmLIWfUgq/fLfATW0KtOZDo
• seshat-se, Mac Secure Enclave: main, commit
  SHA256:fH2+IBmxMTTkfFlwrrm+e8dmhZjw5WdTOAGFKuCPk5c
• chryseikori-se, Mac Secure Enclave: main, commit
  SHA256:Vzkl4/K78dc1t9UkNOKex3ZUuW62u/Z0DVBKmLyD5fM
• athena-se, Mac Secure Enclave: main, commit
  SHA256:yNSBv4tnheZP9bNHOllcLxf1qcXq+LEdqVwE4ebLpEc

Only a recovery signer may change who the recovery and policy signers are; any other change under .repo/ takes a policy signer; and every other commit on main takes a main signer.

How the keys are protected. No automated agent can sign here, and every everyday key lives in hardware it cannot be copied out of: the YubiKey's keys sign only with a touch, and each Mac's Secure Enclave key only with Touch ID on that Mac. A stolen Mac or YubiKey can at most add commits until its key is removed; changing who may sign takes the YubiKey's policy key, which also needs its PIN, or the cold root. The cold root is an Ed25519 key made offline from a seed backed up as split shares, no one of which reveals it, and I use it only on a machine with its network off. It is the one key that can replace the policy signers, so even a lost or stolen policy key can be replaced. A fuller rationale for this design will follow.

Verify it yourself with git and OpenSSH:

git clone https://github.com/ChristopherA/ChristopherA && cd ChristopherA
git -c gpg.ssh.allowedSignersFile=.repo/config/verification/allowed_commit_signers \
  log --format='%h %G? %GS %s'

Every line should show G and the name of the key that signed it.