Signing key registry
Circlworld signing keys
Every Circlworld-signed document carries the fingerprint of the key that signed it. This page lists every signing key Circlworld has ever issued — active, rotated, and revoked — so recipients can independently confirm a fingerprint against a published reference. Verification itself happens at /verify.
Currently used to sign new records. Signatures verify as valid.
Replaced on schedule. Past signatures still verify; not used for new ones.
Withdrawn on suspected compromise. Past signatures return key_revoked.
Key management standard
Signing keys are RSA 4096-bit, asymmetric, sign-and-verify only, held in AWS Key Management Service in eu-west-2 (London). They are generated under a hardware-backed root key, rotated on a quarterly schedule, and operated under a two-person rule. Out-of-cycle rotation occurs only on suspected compromise and triggers a public incident page. The full procedure is in the Member Activity Record Methodology.