Public keys

Both keys belong to the engineer who runs TallTree® — GitHub account @bzmokhtari. They are not stored in this site's repository: every build fetches them from github.com/bzmokhtari.keys and github.com/bzmokhtari.gpg and republishes them verbatim, so what you download here is exactly what GitHub serves — and you can cross-check the two sources independently. A key rotated on GitHub appears here on the next deploy.

The keys

/keys/ssh.txt — the registered SSH public keys, one per line, in OpenSSH format. Use them to verify SSH-signed git commits or to grant repository access.

/keys/pgp.asc — the OpenPGP public key, ASCII-armoured. Use it to encrypt mail to us and to verify PGP-signed artifacts, including the signed copy of /.well-known/security.txt when one is published.

Email us, encrypted

For security reports or anything sensitive, encrypt to the PGP key and send the result to info@talltree.tech:

curl -fsSL https://www.talltree.tech/keys/pgp.asc | gpg --import
gpg --encrypt --armor --recipient behzad@talltree.tech report.txt

The key's user ID is behzad@talltree.tech — that is the address gpg selects it by; mail to either address reaches the engineer who holds the private key. If you are reporting a vulnerability, the disclosure policy says what to include and what to expect back.