# AgentPROV release signing keys (D-1065), in ssh-keygen's allowed-signers format. `agentprov update download` checks
# the release's SHA256SUMS.sig against the keys listed here:
#
#     ssh-keygen -Y verify -f allowed_signers -I PRINCIPAL -n file -s SHA256SUMS.sig < SHA256SUMS
#
# One line per key: PRINCIPAL namespaces="file" KEYTYPE BASE64-PUBLIC-KEY [COMMENT], for example
#
#     agentprov-release namespaces="file" ssh-ed25519 AAAAC3Nza... agentprov-release
#
# Public keys only: a private key never goes here (or anywhere in the repository). While this file lists no key, an
# update is checked against SHA256SUMS alone (fetched over https from the same release), and the check says so; once
# a key is listed, a release without a valid signature by one of these keys is refused.

agentprov-release namespaces="file" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE1ixmkq/Pw4YxgaMDE5zusnVOuh+/5U2pu3LNW2aMlq agentprov-release
