Signing keys

Manage your CNML signing keys. Keys are stored locally in your browser (encrypted in IndexedDB with PBKDF2-derived AES-GCM) and never leave your device. Private keys are released to sign operations only after you enter the passphrase.

Signing keys (private)

Trusted public keys

🔑

No trusted public keys yet

Upload an issuer's .pub.pem to verify CNMLs against their key directly.

Algorithm

ECDSA P-256 (SHA-256) today. Hybrid Ed25519 + ML-DSA-65 (post-quantum) coming.

At rest

AES-GCM-256 with PBKDF2 (100k iters, SHA-256). Salt and IV are random per-key.

Fingerprint

SHA-256 of SPKI public key (hex). Use to compare with recipients out-of-band.