PGPKeynew

PGPKeynew is a cryptographic key management scheme designed to extend the functionality of traditional Pretty Good Privacy (PGP) by incorporating advanced key rotation and metadata encryption features. It was first introduced in 2021 by a consortium of security researchers led by the Center for Open Encryption. The primary goal of PGPKeynew is to address challenges related to key compromise, long-term key management, and auditability in enterprise and open-source environments.

The PGPKeynew architecture builds upon the existing OpenPGP standard while adding a skippable key derivation layer. Each key pair is accompanied by a usage schedule and a cryptographic hash of the public key's metadata. This schedule allows automatic expiration and revocation of keys without manual intervention. Additionally, PGPKeynew supports multiparty derived keys for collaborative projects, enabling fine-grained access control among distributed developers.

Adoption of PGPKeynew has been gradual. Several large organizations have implemented it for securing code signing and infrastructure automation. The project maintains a public key registry that allows third parties to verify the activity and validity of a key without revealing the private key. Despite its benefits, critics argue that the added complexity may reduce interoperability with legacy PGP tools and increase the cognitive load on users unfamiliar with the key rotation process.

Currently, PGPKeynew is maintained as an open-source project on GitHub, with documentation and tooling available for integration into existing PGP workflows. Researchers continue to evaluate its resilience against quantum computing threats, and proposals for future revisions include quantum-resistant hash functions and integration with the Federal Bridge Distribution System.