Key Rotation History
History of all planned and emergency key rotation events.
Annual scheduled rotation from first-generation Ed25519 key to second-generation primary key.
During the overlap window, both keys were valid. Artifacts signed during this period can be verified with either key.
One-month overlap to allow re-signing of long-lived artifacts. Rotation completed without incident. RSA-to-Ed25519 migration already handled separately via revocation.
Annual scheduled rotation activating generation-4 primary Ed25519 key. 44-day overlap window with predecessor.
During the overlap window, both keys were valid. Artifacts signed during this period can be verified with either key.
Extended overlap for major version tag artifacts requiring dual-key verification during transition. All pipelines migrated. No dual-signing complaints received.
Annual scheduled rotation activating generation-5 primary Ed25519 key. 16-day overlap window with predecessor.
During the overlap window, both keys were valid. Artifacts signed during this period can be verified with either key.
Shorter overlap window than prior years due to alignment with certificate expiry date. All pipelines migrated before predecessor retirement.