feat(secrets): stop deploying the retired OpenPGP key (#526)

* feat(secrets): stop deploying the retired OpenPGP key
* chore(flake): bump mysecrets past the move to legacy/

Assisted-by: DeepSeek Harness (claude-opus-5-5)

docs/security-keys.md

@@ -312,10 +312,9 @@ is then retired.
 
 **Switch**, in one sitting:
 
-1. `python3 scripts/gpg_canokey.py pass --backup <drive>/gpg-<fingerprint>.tar.age`. It decrypts
-   every entry with the old key from `/etc/agenix/ryan4yin-gpg-subkeys.priv.age` before changing
-   anything, re-encrypts with `pass init`, then checks that every entry opens with the new key alone
-   and kept its content.
+1. `python3 scripts/gpg_canokey.py pass --backup <drive>/gpg-<fingerprint>.tar.age --old-backup <old-subkeys.age>`.
+   It decrypts every entry with the old key before changing anything, re-encrypts with `pass init`,
+   then checks that every entry opens with the new key alone and kept its content.
 2. Deploy the configuration change to every host that uses pass. Until a host is deployed it cannot
    read the store, and `pass insert` there still encrypts to the old key.
 3. On each host, with a CanoKey plugged in, point the daily keyring's stubs at it:

flake.lock

@@ -493,10 +493,10 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1794375216,
-        "narHash": "sha256-AFc1wbFkjMDE8M5MOoTN+LtjTCeO9eKbEji+l+iPBMQ=",
+        "lastModified": 1794376126,
+        "narHash": "sha256-lDoa+rGdXjwd4czCYy26ye094LMv0eXY4pIpeDcWK7k=",
         "ref": "refs/heads/main",
-        "rev": "77c8376104042b2052ce345a7151c645e4684a51",
+        "rev": "6ab2a713e5938e1bb8ef2d33acab632ba0bd5331",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"

home/base/tui/gpg/default.nix

@@ -20,14 +20,10 @@
     mutableKeys = false;
     publicKeys = [
       # https://www.gnupg.org/gph/en/manual/x334.html
-      {
-        source = "${mysecrets}/public/ryan4yin-gpg-keys-2014-01-27.pub";
-        trust = 5;
-      } # ultimate trust, my own keys.
       {
         source = "${mysecrets}/public/ryan4yin-gpg-keys-2026-11-11.pub";
         trust = 5;
-      }
+      } # ultimate trust, my own key.
     ];
 
     # This configuration is based on the tutorial below, it allows for a robust setup

scripts/gpg_canokey.py

@@ -564,8 +564,8 @@ def build_parser() -> argparse.ArgumentParser:
     store.add_argument("--backup", required=True, help="backup written by `generate`")
     store.add_argument(
         "--old-backup",
-        default="/etc/agenix/ryan4yin-gpg-subkeys.priv.age",
-        help="the retired key's subkeys",
+        required=True,
+        help="the retired key's age-encrypted secret subkeys",
     )
     store.add_argument(
         "--store",

secrets/darwin.nix

@@ -28,10 +28,6 @@
 
   age.secrets =
     let
-      noaccess = {
-        mode = "0000";
-        owner = "root";
-      };
       high_security = {
         mode = "0500";
         owner = "root";
@@ -42,17 +38,6 @@
       };
     in
     {
-      # ---------------------------------------------
-      # No discretionary access; privileged root can still bypass file modes.
-      # ---------------------------------------------
-
-      # .age means the decrypted file is still encrypted by age(via a passphrase)
-      "ryan4yin-gpg-subkeys.priv.age" = {
-        file = "${mysecrets}/desktop/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age";
-        path = "/etc/agenix/ryan4yin-gpg-subkeys.priv.age";
-      }
-      // noaccess;
-
       # ---------------------------------------------
       # only root can read this file.
       # ---------------------------------------------

secrets/nixos.nix

@@ -19,10 +19,6 @@ let
     || cfg.server.webserver.enable
     || cfg.server.storage.enable;
 
-  noaccess = {
-    mode = "0000";
-    owner = "root";
-  };
   high_security = {
     mode = "0500";
     owner = "root";
@@ -89,16 +85,6 @@ in
 
     (mkIf cfg.desktop.enable {
       age.secrets = {
-        # ---------------------------------------------
-        # No discretionary access; privileged root can still bypass file modes.
-        # ---------------------------------------------
-
-        # .age means the decrypted file is still encrypted by age(via a passphrase)
-        "ryan4yin-gpg-subkeys.priv.age" = {
-          file = "${mysecrets}/desktop/ryan4yin-gpg-subkeys-2024-01-27.priv.age.age";
-        }
-        // noaccess;
-
         # Used only by NixOS Modules
 
         "rclone.conf" = {
@@ -134,11 +120,6 @@ in
           user = myvars.username;
         };
 
-        "agenix/ryan4yin-gpg-subkeys.priv.age" = {
-          source = config.age.secrets."ryan4yin-gpg-subkeys.priv.age".path;
-          mode = "0000";
-        };
-
         # Used by a home-manager module, so it must be readable by the user.
         # Setting `mode` makes environment.etc copy the file instead of
         # symlinking the runtime secret, so the owner must be set as well —