blog

Notes on cryptography, keyless systems, and the parts that don't work. I try to write up the limits as carefully as the wins, because a claim that only ever reads green isn't a claim worth checking.

cryptography 31 Aug 2026 · 9 min read

What happened when we took the signing key out

A 2016 signing key, never rotated, read 60,000 State Department emails in 2023 without a single exploit being fired. So I spent a while building on the premise that the key didn't need to be there, and this is what worked plus the five assumptions that don't go away.

Read it →