nimbusvps.com/pgp.txt contents no key, no fingerprint, no armour — this notice and nothing else reason section 2 ask here security@nimbusvps.com 1 — What to do with this today Nothing sent to a nimbusvps.com mailbox can be encrypted to us at the moment, because there is nothing to encrypt to. support@, sales@, abuse@ and security@ are reachable over whatever TLS your provider and ours negotiate between them, and that protection stops when the message lands. For a billing question or a routine abuse report, fine. For a vulnerability report, not fine. Mail security@nimbusvps.com saying that you have something and none of what it is, and we will settle a route with you before you send the rest — Matrix with verified devices, or a key you generate that we encrypt to. It costs a round trip. It is also the only arrangement available right now that we would stand behind afterwards. 2 — Why you are reading English rather than base64 This address used to serve a placeholder dressed in ASCII armour. Armour is a structural promise that a key is inside it, and the tooling tests that promise before any human does: the import fails, the failure looks like a bad download, and the natural response is to fetch it again rather than to doubt the file. Whoever skips the check ends up in a worse position than that, having encrypted to nothing at all and believing otherwise. There is a blunter version of the same objection. A key file is an identity claim, and one we could not have stood behind would have said something unflattering about every other claim published on this domain. 3 — The commands that will produce the key Set down in advance, so that whatever eventually appears at this address can be held against a procedure that was public before it existed. gpg --quick-generate-key \ "NimbusVPS Security " ed25519 sign,cert 3y gpg --quick-add-key cv25519 encr 3y gpg --quick-add-uid "NimbusVPS Support " gpg --fingerprint security@nimbusvps.com gpg --armor --export security@nimbusvps.com > public/pgp.txt gpg --keyserver hkps://keys.openpgp.org --send-keys Line 1 makes an ed25519 primary that signs and certifies. Line 2 puts a curve25519 encryption subkey underneath it. Line 3 is optional and exists only so that one key covers both mailboxes. is whatever line 4 prints. Line 5 is the step that ends this notice — it replaces the present file outright. Line 6 places the key somewhere that is not this server, and keys.openpgp.org will not make an address searchable until it has mailed that address and had an answer, which is the reason to prefer it to a pool that accepts anything. "gpg --full-generate-key" arrives at the same result through prompts, if you would rather answer questions than remember flags. Run it somewhere that is not serving traffic, keep the primary secret key offline, and store the revocation certificate somewhere that will outlive the machine. 4 — The single value that switches the site over src/config/site.ts, at the top of the file: const KEY_FINGERPRINT = ''; The fingerprint is the switch. contact.keyOnFile is computed from it rather than set beside it, so there is no state in which the site says a key is on file and prints nothing after the colon. Filling it in raises the fingerprint and the download button on /contact, the Encryption: field in /.well-known/security.txt, the row in the facts table on /about, the signing statement on /transparency, the answers on /faq and in section 8 of /legal/privacy, and the contact block in /llms.txt — all of them, in a single build. No page anywhere describes the state of this key in its own words, so there is no eighth thing waiting to be forgotten. Order it correctly: line 5 of section 3, then the fingerprint. Any other sequence publishes a claim before the thing it is about. 5 — What to check once a key is here gpg --import pgp.txt gpg --fingerprint security@nimbusvps.com Hold that output against two other things: the fingerprint printed on /contact, and the copy on keys.openpgp.org, reached by typing the keyserver's address yourself rather than by clicking anything on this site. If the three disagree, stop there and tell us on whichever channel you prefer. We would very much rather hear it from you than not hear it. The shape of the problem is worth naming. A key we serve, checked against a fingerprint we also serve, amounts to this server vouching for itself. The keyserver step is not ceremony — it is the only part of the exercise that still works if we have been compromised.