security.txt is deployed unsigned — GPG_PRIVATE_KEY not set up

[davidwkeith]

Summary

/.well-known/security.txt is currently deployed unsigned. Postbuild logs on every deploy:

PGP: GPG_PRIVATE_KEY not set, skipping security.txt signing.

Background

• scripts/postbuild.ts calls signSecurityTxt() from @dwk/eleventy-shared, which reads the armored key from process.env.GPG_PRIVATE_KEY and skips gracefully if it's unset (by design).
• README.md says to add GPG_PRIVATE_KEY to a .env file, but until 52ee1e3 the postbuild script never actually loaded .env into the process — that mismatch is now fixed (node --env-file-if-exists=.env).
• No .env file exists in this checkout yet, so signing is still skipped on deploy.
• A matching secret key already exists in the local GPG keyring (me@dwk.io, ultimate trust) — nothing needs to be generated.

Fix

Export the existing key into a local, gitignored .env:

{
  echo "GPG_PRIVATE_KEY=\"$(gpg --armor --export-secret-key me@dwk.io)\""
} >> .env

Then redeploy (npm run deploy) to confirm security.txt is signed.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_014KCeDbjWckJBP1qZVnjJTK