Keys and purpose templates

A key is created with one word: its purpose. The purpose template sets what the key may do and fixes what it may never do. There is no attribute checklist and no switch that makes a private key exportable.

Create a key

roost key create --purpose code-signing --name release-signing
roost key create --purpose data-key --name data-key-eu --partition prod
roost key create --purpose tls --name tls-www --subject "CN=www.example.com"

Purpose templates

Purpose	Algorithm	May	Never
`code-signing`	ECDSA P-256 or P-384, RSA-3072	sign	decrypt, export
`document`	ECDSA P-256, RSA-3072	sign	decrypt, export
`ca`	ECDSA P-384, RSA-3072	sign (certificates)	decrypt, export; approval required by default
`tls`	ECDSA P-256, RSA-3072	sign (handshake)	export, wrap
`data-key`	AES-256-GCM, ARIA-256-GCM	wrap, unwrap, encrypt small data	export; decrypt bulk data inside the box
`kek`	AES-256-KWP	wrap, unwrap	export, encrypt data directly
`hmac`	HMAC-SHA-256 / 384	seal, verify	export
`agent`	ECDSA P-256	sign within limits	export; approval required above limits

Birth record

Every key born inside Roost carries a birth record: the box serial, the time, the purpose, and a signature from two of the three chips. A key that was imported carries an import record instead, permanently. Auditors can tell the two apart.

roost key show release-signing

name        release-signing
purpose     code-signing
version     v3 (active) · v2 (verify-only) · v1 (retired)
born in     ROOST-26-0001 · 2026-09-02 · signed by 2 of 3 chips
policy      approval required (2 seals) · limit 50/h
export      never

Versions and rotation

A key has versions. The active version signs or wraps; older versions verify or unwrap until they are retired. Rotation is scheduled or on demand and needs the key's approval policy.

State	Signs / wraps	Verifies / unwraps	Retire
Standby	no	no	—
Active	yes	yes	—
Verify-only / decrypt-only	no	yes	when no record depends on it
Retired	no	no	—

roost key rotate data-key-eu            # v2 becomes active, v1 decrypt-only
roost key retire data-key-eu --version v1   # refused while 0 < records still on v1

A version that records still depend on cannot be retired. The console shows how many records remain, and the count must reach zero first.

Partitions

A key lives in one partition. See Partitions.