Rules for the effective use of cryptography, including cryptographic key management, should be defined and implemented.
Private keys (RSA 4096-bit keys strictly) never leave the hardware token and require physical PIN entry and touch confirmation for every operation. Even compromised workstations cannot access keys.
Let's Encrypt certificates auto-renew every 3 months. Sealed Secrets controller keys rotate monthly. No manual rotation overhead, zero key expiry incidents.
We enforce commit signing with yubikey otherwise commits won't be pushed - blocked by gitea runners.
We enforce all commits to be signed using our YubiKey GPG keys. Unsigned or local keys signed commits are rejected by Gitea runners. , ensuring provenance, authenticity, and tamper-resistant change history across the codebase.