How-to guides¶

Task-oriented recipes for someone who already knows the basics. If you are new, start with the tutorial.

• Provision the KMS keys — the two keys the design needs, and the reader/certifier split between them.
• Decrypt with AWS KMS — wire the provider so the private key never leaves the service.
• Assemble a KMS-backed certificate — emit a publishable certificate whose primary and encryption subkey are both KMS keys.
• Select a key service at runtime — resolve --backend aws-kms without importing every provider.
• Implement a key service — plug in something that is not AWS.
• Test without a key service — drive the seams with the shipped mocks.
• Read a certificate — recover a message's derivation parameters, with the subkey binding verified.
• Verify against GnuPG — check a certificate with the implementation your correspondents actually run.