Module signing 

Ed25519 signatures over the vault — integrity against an active attacker with write access to the repo.

The keyed BLAKE3 MAC (see lib.rs) binds ciphertexts together but does NOT authenticate the author. The MAC key lives inside the age-encrypted meta blob, and age encryption needs only the recipients’ public keys — which sit in the plaintext header. So anyone who can write to the repo can mint a fresh MAC key, recompute a valid MAC over tampered content, and re-encrypt meta; the MAC then verifies clean. See THREAT_MODEL.md.

Signatures close this for non-recipient attackers: a writer signs the vault with an Ed25519 key derived from the same BIP39 seed as their age key, and loaders verify the signature against the signer’s registered verifying key. An attacker holding no recipient private key cannot forge a valid signature.

“Sign-when-capable”: native age keys (the murk init default) derive a signing key deterministically, and ssh-ed25519 keys sign with the key itself (see the ssh-ed25519 section below). ssh-rsa and hardware/plugin identities cannot sign, so their saves are left unsigned (a warning, not an error). A present signature must verify — an invalid one is tampering and hard-fails.

Functions

ed25519_signing_key_from_openssh

Parse an Ed25519 signing key from an OpenSSH private-key PEM.

ed25519_verifying_key_b64_from_ssh_recipient

Extract the base64 Ed25519 verifying key from an ssh-ed25519 <base64> [comment] recipient string. Tolerates a trailing comment. Returns None for non-ed25519 or unparseable input. The encoding matches what verify expects.

sign

Sign a message, returning the base64-encoded 64-byte signature.

signing_key_from_age_bytes

Derive an Ed25519 signing key from the raw 32-byte age x25519 secret.

ssh_ed25519_key_eq

Whether two strings name the same ssh-ed25519 key, ignoring any trailing comment. Both must be ssh-ed25519 <base64> [comment]; only the key type and base64 blob are compared. Needed because recipients may be stored with a comment while an identity’s pubkey_string() drops it.

verify

Verify a base64-encoded signature against a base64-encoded verifying key.

verifying_key_b64

The base64-encoded Ed25519 verifying (public) key for a signing key.