Explanation¶

Understanding-oriented. Why this module looks the way it does, and which parts of that were forced by AWS or OpenPGP rather than chosen.

Concepts¶

• Why RSA cannot work — the single most important thing to know. It is a padding mismatch, and it is absolute.
• The two-key structure — why an OpenPGP encryption key cannot stand alone.
• Rotation, retention and deletion — which operation actually loses messages, and why it is not the obvious one.

Components¶

• Roles and trust — the reader/certifier split, the rebind threat, MFA and federated sessions.
• Key policies — the four principal classes, and why there is no Deny.

The decision record¶

These pages explain the design. The spec records how each decision was reached, what was rejected, and what is still open — including the one question that gates publishing a certificate at all.