operator:key-2026-09. This is the value carried in operator_key_id on every record the key signs.13a9686950ae20f37ca522b61f077fb36b3360374a7504cfbffc004ec0de7299SubjectPublicKeyInfo, PEM
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMUs/S4a6kIemn68nyZt6YBVNKnd0
/d484ngDbb1og53oJfS6LoW98EU2HKuX1ZRVST5IFwtiIUsWUKME/cGJxw==
-----END PUBLIC KEY-----
To confirm you have the right key, compute the SHA-256 of the DER encoding of this SubjectPublicKeyInfo and compare it to the fingerprint above. With OpenSSL: openssl pkey -pubin -in key.pem -outform DER | sha256sum.
What happens when this key is retired
A key rotation is itself a ledger entry, sealed under the retiring key, naming the incoming one and the index from which it applies. The retired key’s public half stays published here indefinitely, whatever happens to the private half, so that every historical record remains verifiable forever. A record signed by a key that cannot be resolved from this page is non-conforming, and a verifier is required to fail on it rather than try other keys.
Where a rotation is due to suspected compromise, the rotation record says so, names the ledger index from which entries are suspect, and that index may not be later than the last independently published root before discovery.