feat: Removed ben and added k9ert keys for releasing (#306)
What the developer wrote
Authored by k9ert
feat: Removed ben and added k9ert keys for releasing (#306)
What changed, and why it matters
This commit updates the list of trusted public keys used to sign firmware releases for the Specter DIY hardware wallet. One maintainer's key (ben) was removed and another maintainer's key (k9ert) was added. There is no code change that introduces a vulnerability or fixes one; it is purely a release-process key rotation.
No security action required. If you are a downstream builder or user, verify that the new key (k9ert) belongs to a trusted maintainer and that the old key (ben) is properly revoked in your release verification workflow.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change affects the bootloader’s release-key trust list (1 insertion, 1 deletion). It removes one authorized signing key and adds another. Without the actual diff, the only security-relevant observation is that any device relying on this list will now accept releases signed by k9ert and reject those signed by ben. This is an administrative/key-management change, not a cryptographic or software flaw.
Changed components
bootloader release-key configurationInspect captured patch +1 / −1
Diff not available from the source API.Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.