dual signing keys (Was: Support for signing key on hardware security modules)

[Cantor, Scott]

> Yes but you (as metadata owner) do not have a way to update the
> metadata apart from "login to the web UI and update." That wouldn't
> work if you wanted to rotate keys daily or weekly or even monthly.
> That's an interesting problem in general.

Well, obvously, an API for that would be eminently possible. It is true that it's not today, but if you're talking *one* UI to update vs. 200, this is hardly the dumbest or most onerous thing I have to do monthly, believe me. But it's not one of course, so it's a theoretical point.

Honestly if the auditors decided there were only 10 or so really "must fix" integrations, a student employee could be trained to update all those monthly. I simply don't know what we'll decide we have to do yet.

-- Scott