Automatically sync OpenPGP public keys across an organization to simplify GPG key management.
GPG Sync is an open-source tool that automates the distribution and updating of OpenPGP public keys across an organization. It solves the scalability problem of manual GPG key management by using a centralized keylist that clients sync with, ensuring everyone has up-to-date keys without manual intervention. This prevents the use of revoked keys and simplifies onboarding and key transitions.
Organizations and teams that rely on GPG for internal encrypted communication and need a scalable, low-maintenance solution for key distribution. It's particularly useful for groups where members frequently join, leave, or rotate keys.
Developers choose GPG Sync because it eliminates the manual overhead of GPG key exchanges, reduces human error, and ensures cryptographic hygiene by automatically refreshing keys. Its adherence to an emerging IETF standard and support for modern keyservers offer a future-proof, secure alternative to ad-hoc key management.
:lock: GPG Sync is designed to let users always have up-to-date public keys for other members of their organization
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
A single trusted administrator maintains a JSON keylist, eliminating the need for manual key exchanges across the organization, as outlined in the README.
Clients periodically fetch and import new keys or refresh revoked ones without user intervention, ensuring cryptographic hygiene and reducing human error.
Adheres to the IETF draft standard for Distributing OpenPGP Keys with Signed Keylist Subscriptions, promoting interoperability and future-proofing.
Defaults to the modern, abuse-resistant keys.openpgp.org, moving away from vulnerable SKS networks to enhance security.
Mandates that all keys have email addresses and users opt-in to keys.openpgp.org, which can be a privacy hurdle and administrative burden, as cautioned in the README.
Relies on a trusted administrator to manage the keylist; if compromised or unavailable, it disrupts key distribution for the entire organization.
Depends on external keyservers for key fetching, introducing potential downtime or issues if servers change or become unavailable, despite fallback options.