Follow-up from the 2026-08-21 revalidation of #73 (now closed: add-key is fully implemented).
lo secrets add-key adds an age recipient to every .sops.yaml creation rule and re-keys the store. There is no remove-key — so revoking a departed teammate's recipient means hand-editing .sops.yaml across every domain and re-encrypting, with no orphan check.
Scope: mirror add-key's semantics in reverse — drop the recipient from all creation rules, re-key the store, refuse (or warn) if removing it would orphan a file that no remaining recipient can decrypt. --all for cross-domain, same as add-key.
Not urgent, but it is the half of key management that matters during offboarding.
🤖 Generated with Claude Code
Follow-up from the 2026-08-21 revalidation of #73 (now closed:
add-keyis fully implemented).lo secrets add-keyadds an age recipient to every.sops.yamlcreation rule and re-keys the store. There is noremove-key— so revoking a departed teammate's recipient means hand-editing.sops.yamlacross every domain and re-encrypting, with no orphan check.Scope: mirror add-key's semantics in reverse — drop the recipient from all creation rules, re-key the store, refuse (or warn) if removing it would orphan a file that no remaining recipient can decrypt.
--allfor cross-domain, same as add-key.Not urgent, but it is the half of key management that matters during offboarding.
🤖 Generated with Claude Code