Regular key rotation is a best practice that improves security. Even if the underlying ciphers have not changed, the value of a stolen key will decay when ther

Regular key rotation is a best practice that improves security. Even if the underlying ciphers have not changed, the value of a stolen key will decay when there is a planned sunset. In the lack of a rotation strategy, a stolen key is a gift that keeps on giving. OpenBSD introduced the signify command, and a 6-month key rotation, that will allow trust when the OS is downloaded over insecure channels (cleartext FTP and http). https://www.openbsd.org/papers/bsdcan-signify.html https://www.openbsd.org/papers/bsdcan-signify.html Debian is migrating to the conceptually-similar aptsign. https://blog.jak-linux.org/2021/06/20/migrating-away-apt-key/ https://blog.jak-linux.org/2021/06/20/migrating-away-apt-key...