- Fires when
- A notice claims the signing fingerprint has changed.
- First move
- Nothing at all. Keep using the pin you have.
- What settles it
- Consistency across independent places over several days. No single message can.
- What never settles it
- A signature on the notice itself, because anyone holding the old key could produce one.
- The mistake
- Acting inside the stated period. Nothing about a key change requires it.
Why this one is genuinely hard
It is self undermining. Anyone able to compromise the old key can sign a handover with it, so a valid signature on a rotation notice proves less than a valid signature normally does. And a real key change does have to happen somehow, so refusing all of them is not a workable policy either.
This is the one place where the confident advice everywhere else on this site runs out, and saying so is better than pretending otherwise.
What to do
- Do nothing immediately. Nothing about a key change requires action within an hour, a day, or a week. Pressure to act sooner is the tell.
- Keep using the old pin. If material still verifies against it, the old key is still in use and the notice is at best premature.
- Wait several days, then check independent places. Three pages by one operator count as one source.
- Let agreement accumulate. A real change shows up in more than one place, persists, and is reflected wherever the old fingerprint appeared.
- Treat a single source claiming a change as no evidence, however official it looks or however well it explains itself.
The variant that catches people
A notice that does not announce a rotation at all, and simply offers a key alongside something signed by it, with instructions for checking one against the other. Everything is internally consistent because one party produced all three, and internal consistency is free for a forger. That is the whole reason pinning is a separate task done once, from sources that had nothing to do with the page in front of you.