# Attach an OpenPGP signing key

Link a proven OpenPGP signing key to a persona and resolve its current attachment.


**Ships** — server routes for attachment, revocation, listing and signer resolution. Mail and document integrations are **Build today**.

Use an existing OpenPGP signing key with TrustGraph. A usable ordinary graph device authorizes the attachment, and the selected OpenPGP key separately proves possession. Start with [early access](/early-access) and an allowlisted app origin on staging.

## 1. Attach one signing key

`POST /v1/external-keys/attach` accepts a device-signed `attach-external-key` action, an armored public key and a clearsigned proof. The action binds the selected fingerprint, sanitized key-material digest and proof digest. The proof binds the persona, selected fingerprint, material digest and nonce.

This is an HTTP integration: typed SDK wrappers for these routes are not available yet. Follow the [external-key reference](/api/external-keys) for exact bytes and supported OpenPGP formats. Do not substitute a hash of the original armor for the canonical sanitized-material digest.


**Establishes**
An attachment associates the one proven primary key or signing subkey with the persona at attachment time. Sibling signing keys need their own attachments.

## 2. Verify the document, then resolve the signer

Verify the mail, document or Git signature locally and obtain its actual signing fingerprint. Send a signed `resolve-external-signer` read to `POST /v1/external-keys/resolve-signer`, using your own `graphNodeId` and exactly one locator: `signingFingerprint` or `signingKeyId`.

The response contains a certificate and status. Verify both issuer signatures against your pins; recompute the signing packet's fingerprint; match the locator, certificate digest, request nonce and freshness. An absent, ambiguous, revoked or inactive attachment returns the same unavailable response. Prefer the full fingerprint when you have it.

## 3. Check a path and keep the result fresh

Query from your own node to the resolved persona and [verify the proof locally](/build/trust-gated-features). If that check takes more than 30 seconds after status evaluation, resolve again and require the same node and fingerprint. Recheck expiry immediately before showing a current result; the API reference defines the result's validity bound.

## 4. Revoke an attachment

Use `POST /v1/external-keys/:externalKeyId/revoke` with a signed `revoke-external-key` action. Revocation is terminal for that fingerprint: it cannot be attached again, even to the same persona. Own-node listing includes revoked records.


**Does not establish**
Attaching makes a fingerprint-to-persona link resolvable by authenticated graph members who know the locator. It does not establish historical key control, authorship or code safety. Later OpenPGP expiry or revocation is not automatically refreshed after import; revoke the TrustGraph attachment explicitly. Document signature expiry still applies. The full submitted public block reaches the server for validation, although user IDs, names, email addresses and photos are not retained.