v0.11.0

Attest with a key that is not on this machine

A PGP key on a card, an air-gapped box, or a phone can now attest from the CLI. Print the line, sign it where the key is, bring two files back:

thurin attest --statement --owner you.eth > line.txt
# where the key is: gpg --clearsign line.txt > signed.asc; export the public key to pub.asc
thurin attest --key-file pub.asc --statement-file signed.asc --owner you.eth --no-key

--statement writes only the line to stdout, so it pipes straight into gpg --clearsign. The second command skips gpg and runs the same checks as always: email names stripped, size limits, fingerprint match, signature verified against the key. Every exit is unchanged: send from the keystore, --no-key for a thurin.id link, or --authorize with --signer or --sign-out, so the Ethereum half can be signed on the card as well.

reattest takes both files. update-key takes --key-file alone, since it signs nothing new. A detached signature is refused with a hint to clearsign. Nothing here is specific to any card or curve.

Also

• Built on identity-kit 1.3.2, which keeps openpgp.js's own curve rejections and lifts only secp256k1, instead of clearing the list.
• Named on-chain from thurinlabs.eth: thurin record get thurinlabs.eth thurin.pointer

Verify this release: https://docs.thurin.id/#/guides/verify-release