SECURITY.md: remove Jonas Nick from trusted keys
What the developer wrote
Authored by Jonas Nick
SECURITY.md: remove Jonas Nick from trusted keys
What changed, and why it matters
This commit updates documentation to remove one person's cryptographic key from the project's list of trusted security contacts, and updates the README's example release tag and signature to reflect a newer release signed by a different trusted developer. It is a policy/documentation change, not a code fix for a software vulnerability.
No immediate code-level action is required. Users and reporters relying on SECURITY.md should note the updated contact list. If you previously used Jonas Nick's key for encrypted disclosure, use the remaining listed keys. Monitor project communications for any explanation of the key removal.
Security signals we found
Removal of a trusted GPG key from SECURITY.md contact list
Update of release-tag verification example to a newer release and different signer
No code or cryptographic implementation changes
Evidence from the diff
The patch modifies SECURITY.md to remove Jonas Nick’s GPG fingerprint from the list of keys for sensitive disclosures, and updates README.md verification example from release v0.6.0 (signed by Jonas Nick) to v0.7.1 (signed by Pieter Wuille). No source code, build system, or cryptographic algorithms are changed. The commit itself does not explain why the key is being removed.
Changed components
SECURITY.mdREADME.mdInspect captured patch +9 / −9
diff --git a/README.md b/README.md
index 90edae1..daa38d4 100644
--- a/README.md
+++ b/README.md
@@ -81,20 +81,21 @@ This can be done with the following steps:
```
4. Check out the latest release tag, e.g.
```
- git checkout v0.6.0
+ git checkout v0.7.1
```
5. Use git to verify the GPG signature:
```
- % git tag -v v0.6.0 | grep -C 3 'Good signature'
+ % git tag -v v0.7.1 | grep -C 3 'Good signature'
- gpg: Signature made Mon 04 Nov 2024 12:14:44 PM EST
- gpg: using RSA key 4BBB845A6F5A65A69DFAEC234861DBF262123605
- gpg: Good signature from "Jonas Nick <jonas@n-ck.net>" [unknown]
- gpg: aka "Jonas Nick <jonasd.nick@gmail.com>" [unknown]
+ gpg: Signature made Mon 26 Jan 2026 07:42:46 PM UTC
+ gpg: using RSA key 2840EAABF4BC9F0FFD716AFAFBAFCC46DE2D3FE2
+ gpg: Good signature from "Pieter Wuille <pieter@wuille.net>" [unknown]
+ gpg: aka "Pieter Wuille <pieter.wuille@gmail.com>" [full]
+ gpg: aka "[jpeg image of size 5996]" [undefined]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
- Primary key fingerprint: 36C7 1A37 C9D9 88BD E825 08D9 B1A7 0E4F 8DCD 0366
- Subkey fingerprint: 4BBB 845A 6F5A 65A6 9DFA EC23 4861 DBF2 6212 3605
+ Primary key fingerprint: 133E AC17 9436 F14A 5CF1 B794 860F EB80 4E66 9320
+ Subkey fingerprint: 2840 EAAB F4BC 9F0F FD71 6AFA FBAF CC46 DE2D 3FE2
```
Building with Autotools
diff --git a/SECURITY.md b/SECURITY.md
index b515cc1..4be32e4 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -9,7 +9,6 @@ The following keys may be used to communicate sensitive information to developer
| Name | Fingerprint |
|------|-------------|
| Pieter Wuille | 133E AC17 9436 F14A 5CF1 B794 860F EB80 4E66 9320 |
-| Jonas Nick | 36C7 1A37 C9D9 88BD E825 08D9 B1A7 0E4F 8DCD 0366 |
| Tim Ruffing | 09E0 3F87 1092 E40E 106E 902B 33BC 86AB 80FF 5516 |
You can import a key by running the following command with that individual’s fingerprint: `gpg --keyserver hkps://keys.openpgp.org --recv-keys "<fingerprint>"` Ensure that you put quotes around fingerprints containing spaces.
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.