B
BetterSign
· Key Rotation
1 / 3
‹
›
👤 you
🔑 new key
🔑
🖥️
server
copying…
OLD
🔑
⚙️
CI job
missed one
✗ BROKE
📦
container
baked-in old key
OLD
🔑
💻
laptop
offline, not updated
✗ STALE
Hand-deliver the new key to every one — and until you do, things break. So most teams just never rotate.
Your name never changes:
vlad:z6Mk…acme
Entry 1
genesis
/keys/primary: k0
signed ✓
→
Entry 2
prev: cid(1)
/keys/primary: k0
signed ✓
→
Entry 3 · rotate
prev: cid(2)
/keys/primary:
k1 (new)
signed by k0 ✓
Rotating is just
one new signed page
in your logbook. The VLAD on the cover is identical.
You announce the new head
once
to VLADemlia — no key is pushed anywhere.
🖥️
follower
pulls & verifies
OLD
✓ NEW
⚙️
CI job
pulls & verifies
OLD
✓ NEW
📦
service
pulls & verifies
OLD
✓ NEW
💻
peer
pulls & verifies
OLD
✓ NEW
Converged.
Old key retired everywhere · 0 keys hand-delivered · 0 downtime