@botteaap This is also my own nightmare scenario because I no longer use GPG for anything other than Maven Central and I genuinely couldn't tell you when the current key expires and how to rotate it.

My kingdom for sigstore.dev and Trusted Publishing through GitHub/GitLab so I never have to think about that garbage ecosystem again :blobUgh: