Hum... I think you're misunderstanding something. You have a username/password to Maven Central and you also have a private key to it. But in order to be gran

Hum... I think you're misunderstanding something. You have a username/password to Maven Central and you also have a private key to it. But in order to be granted a groupID (think of it as an account), you need to prove at the time of account creation that you own the domain that matches the groupID (think account name). So if you try to register com.foo on Maven Central, at that time you need to own foo.com, otherwise you'll be rejected. If you do own it at that time, well your account is approved and now you have a username/password to it and a private key you need to use to sign artifacts when you publish them. If your domain expires and is later bought by someone else, that doesn't make them the new owner of your Maven Central groupID.