Key management on Tom Meurs

GPG explained: from first key to daily use

Tue, 06 Jan 2026 19:00:00 +0100

TL;DR GPG encrypts files and signs things, and it sits under pass, under signed git commits and under the checksums maintainers publish. One command gives you a working keypair in five minutes. Subkeys and a YubiKey come later, if ever, and the UX is bad enough that I complain about it at length below.

GPG is a tool I kept meaning to learn and didn’t, for years. The docs are a wall of text, the terminology is its own dialect, and the error messages are cryptic in both senses of the word.

Pass: the Unix password manager that just works

Sat, 10 Jan 2026 12:00:00 +0100

TL;DR pass keeps each password as a GPG-encrypted file in a directory, and the directory is the whole data model. pass -c email/gmail puts a password in your clipboard from any terminal, pass git push backs the store up, and the fzf script further down is how I look up every password I have. The price is GPG key management, and it’s a real price.

I used KeePass for years. Then 1Password. Then Bitwarden. All decent tools, and every one of them was too much for what I asked of it. Too much UI, too many features, and a password always lived on the other side of an app I had to alt-tab into. A small interruption, and they added up.

YubiKey + Pass + GPG + SSH: One Key to Rule Them All

Tue, 13 Jan 2026 17:00:00 +0100

TL;DR One YubiKey carries a GPG key with a signing, an encryption and an authentication subkey. gpg-agent hands the authentication subkey to SSH, git signs with the signing subkey and pass decrypts with the encryption subkey, so one PIN in the morning and a touch per action replace every password I used to type. The SSH part alone is three steps and worth doing on its own.

Every morning I plug in my YubiKey, type one PIN, and that’s the last secret I type until I pull it out again. SSH to a server, no password. Sign a commit, no passphrase. Pull a secret out of pass, touch the key. One thing in a USB port, and the rest of the day my authentication happens without me.

Quantum-safe GPG identity with multiple aliases

Sat, 18 Apr 2026 10:47:00 +0200

TL;DR One GPG masterkey that only certifies, kept offline. Three aliases bound to it, so anyone can check they’re the same person. Ed25519 subkeys for signing and SSH, an ML-KEM plus X448 subkey for encryption so recorded ciphertext stays closed after a quantum computer shows up, and three backups that each assume the other two are gone. Needs GnuPG 2.5.

A cryptographic signature still means exactly what it says. If the key is yours and the signature verifies, the content came from you. No vendor handed you that identity, no CA can pull it, no platform can suspend it. It exists because you generated the key, and it’s yours for as long as you hold the private half. Most of what gets called “online identity” is borrowed. A handle someone can ban, an email address the domain owner can take back the day they feel like it. A GPG signature sits outside all of that.