Merge pull request #4: README key rotation note

README: key rotation for revoking old kits is on the backlog
2026-10-07 02:26:19 +02:00
parent a0c1f1cd58 0eb23f56e7
commit 550249570b
1 changed files with 2 additions and 1 deletions
@@ -63,7 +63,8 @@ All backups of an installation are encrypted with one master key.
  a single slot is possible, but then that one passphrase is a single point of failure.
 - When a holder leaves, give their slot a new passphrase (`occ backup:key:slot:replace`), download
  the new kit and confirm it. Note: an old kit together with the old passphrase still opens the
-  same master key; to revoke it completely, start new locations with a new key.
+  same master key; to revoke it completely, start new locations with a new key. This is noted on
+  the backlog and will be addressed in a future version (key rotation).
 - Downloading the kit, and every change to the slots, requires the administrator's password, is
  written to the audit log and is announced to all administrators.