Use cases / Signing keys
PGP master keys — lose them and the web of trust built on them is gone, expose them and every signature can be forged.
The problem
Creating or managing PGP master keys on an everyday computer exposes them to malware, keyloggers and clipboard monitors — even if encrypted. A compromised signing key means forged releases and broken trust.
If a PGP master key is lost, all subkeys and web of trust built around it are gone. There is no recovery process — you start over from scratch.
Provisioning YubiKeys with master keys on a connected computer defeats the purpose of air-gapping keys on hardware security devices.
Managing PGP master keys, generating subkeys and provisioning YubiKeys is complex and error-prone — mistakes can compromise entire web of trust.
The solution
Back up master key in an encrypted file called a standalone archive — created on Superbacked OS, air-gapped from malware, keyloggers and clipboard monitors.
Learn more →Back up master key in a detached archive bound to a blockset — distribute blocks among designated team members, establishing governance that survives the unthinkable.
Learn more →Boot Superbacked OS on dedicated hardware. Use yubikey-prov to generate PGP master key, create subkeys and move subkeys to YubiKey. Master key is written to Desktop — nothing persists to disk after shutdown.
Use Superbacked app to create standalone archive containing master key. Archive is encrypted using passphrase — store archive safely alongside other critical files.
For a second factor, enable YubiKey protection — without it, passphrase alone cannot unlock archive.
To restore, boot Superbacked OS on dedicated hardware, drag archive into Superbacked, enter passphrase (and plug in provisioned YubiKey if YubiKey protection is enabled) and restore master key to Desktop.
Boot Superbacked OS on dedicated hardware. Use Superbacked app to create detached archive containing master key bound to a blockset. Choose threshold (2-of-3, 3-of-5 or 4-of-7) — master key lives in archive while encryption keys live in blocks.
Share passphrase with designated parties, distribute blocks to company vault, outside counsel and designated team members and store archive alongside other critical files.
When the time comes, designated team members boot Superbacked OS on dedicated hardware, gather required number of blocks, enter passphrase, then drag and drop archive to restore master key to Desktop.
No solution protects against everything — being honest about that is part of earning your trust.
Superbacked enforces strong passphrases but cannot prevent reuse. If passphrase is reused from a breached service, brute-force protection is bypassed unless block or archive is also protected with YubiKey. Use built-in passphrase generator.
If you lose passphrase, block, archive or derived secret becomes permanently unrecoverable. Store passphrase in your password manager or another secure location.
If block, archive or derived secret is protected with YubiKey and YubiKey is lost, secret becomes permanently unrecoverable — passphrase alone is not enough. Back up challenge-response secret or provision a second YubiKey.
If someone gains access to both block and passphrase — for example, through unlocked password manager — secret is compromised. Lock devices when away.
If malware is running on computer when you create a block, archive or derived secret, secret could be captured before encryption. For high-stakes secrets, use Superbacked OS.
Superbacked protects master keys at rest but does not protect against subkeys that are already on a compromised YubiKey or machine. Revoke and reissue subkeys if breach is suspected.
If enough custodians collude to meet threshold, they can recover secret without authorization. Choose custodians carefully and set thresholds that reflect your trust model.
For high-stakes secrets, use Superbacked OS — a hardened operating system that runs offline and persists nothing to disk.
Explore other use cases: critical credentials, digital assets and personal backups.
Copyright (c) Superbacked, Inc.