Embed Notice

@brandon @evan my main observation here is that end-users should never have to think about or manage their keys, because (1) they don't care and (2) ultimately they will lose their keys.

For those reasons alone, key management is a hard problem, and will always remain a hard problem.

If an architectural solution depends on keys, service providers need to be prepared to reissue those keys on behalf of their users, and the architecture should be capable of handling disjointed key rotation.