Kyle Isom 5529fff649 Step 24: DEK rotation. ...

RotateDEK generates a new DEK, re-encrypts all encrypted blobs, and
re-wraps with all existing KEK slots (passphrase + FIDO2). CLI wired
as `sgard encrypt rotate-dek`. 4 tests covering rotation, persistence,
FIDO2 re-wrap, and requires-unlock guard.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-24 12:01:57 -07:00

..

sgard

Step 24: DEK rotation.

2026-03-24 12:01:57 -07:00

sgardd

Step 23: TLS transport for sgardd and sgard client.

2026-03-24 11:57:03 -07:00