<p>I chatted to Wladimir about this. He hasn't switched to a new key, he's just using a separate key to sign binary releases.</p>

<p>Additionally, he has signed the new key with the old key, so there's an audit path.</p>

CC BY-SA 3.0
2016-05-22T23:06:05.170Z
any idea why he's using a different key to sign the binaries?
mulllhausen
CC BY-SA 3.0
2016-05-23T11:03:04.613Z
Separation of responsibilities - if one is compromised it does not compromise the other, and it can be revoked without affecting the other.
fluffyponyza
CC BY-SA 3.0
2016-05-22T14:10:54.870Z
2016-05-22T14:10:54.870Z
fluffyponyza
<p>Maybe he is worried his old key was compromised somehow? If that is the case I would be careful about trusting anything signed with the old GPG key after the soonest date it could have been compromised.</p>

<p>I don't see a reason to worry about future releases he signs with his new GPG key.</p>

CC BY-SA 3.0
2016-05-21T11:25:21.813Z
in the reddit notice he says he is continuing to use his old key to sign git commits, so he must still trust it.
mulllhausen
CC BY-SA 3.0
2016-05-21T11:09:39.160Z
2016-05-21T11:09:39.160Z
Javier
<p>I just went to install the latest version of bitcoind and discovered that Wladimir has signed the <a href="https://bitcoin.org/bin/bitcoin-core-0.12.1/SHA256SUMS.asc">https://bitcoin.org/bin/bitcoin-core-0.12.1/SHA256SUMS.asc</a> file with a new GPG key: <a href="https://bitcoin.org/laanwj-releases.asc">https://bitcoin.org/laanwj-releases.asc</a>. His previous key was <a href="https://bitcoin.org/laanwj.asc">https://bitcoin.org/laanwj.asc</a>.</p>

<p>Some Googling turned up <a href="https://www.reddit.com/r/bitcoin_devlist/comments/3bsw31/new_gpg_signing_key_for_bitcoin_core_binary/">this notice on reddit</a> but he doesn't say why he started using a new key. Does anybody know why he switched keys? Are there any good reasons to switch keys? Should I be worried?</p>

<bitcoind><bitcoin-core-development><authentication>
Wladimir's new GPG key
mulllhausen
# Wladimir's new GPG key

(Asked by: username_0 on 2016-05-21)

I just went to install the latest version of bitcoind and discovered that Wladimir has signed the <https://bitcoin.org/bin/bitcoin-core-0.12.1/SHA256SUMS.asc> file with a new GPG key: <https://bitcoin.org/laanwj-releases.asc>. His previous key was <https://bitcoin.org/laanwj.asc>.

Some Googling turned up [this notice on reddit](https://www.reddit.com/r/bitcoin_devlist/comments/3bsw31/new_gpg_signing_key_for_bitcoin_core_binary/) but he doesn't say why he started using a new key. Does anybody know why he switched keys? Are there any good reasons to switch keys? Should I be worried?

**Tags:** bitcoind, bitcoin-core-development, authentication


---

## 2 answers

### Answer by username_1 on 2016-05-22. Score: 3 | Accepted answer

I chatted to Wladimir about this. He hasn't switched to a new key, he's just using a separate key to sign binary releases.

Additionally, he has signed the new key with the old key, so there's an audit path.

> **Comments:**
> **username_0**: any idea why he's using a different key to sign the binaries?  
> **username_1**: Separation of responsibilities - if one is compromised it does not compromise the other, and it can be revoked without affecting the other.  

---

### Answer by username_2 on 2016-05-21. Score: 1

Maybe he is worried his old key was compromised somehow? If that is the case I would be careful about trusting anything signed with the old GPG key after the soonest date it could have been compromised.

I don't see a reason to worry about future releases he signs with his new GPG key.

> **Comments:**
> **username_0**: in the reddit notice he says he is continuing to use his old key to sign git commits, so he must still trust it.  

---

