Would it be possible to add similar support for GPG keys?

I'm still super interested in this because I'd like to be able to more natively use 1password as the central hub to store keys used to sign published artifacts generated in CI. It'd be super-handy if I could easily generate a new signing subkey and revoke one which was compromised when a CI system's cloud provider gets hacked again, all without having to change a thing about the ci logic. Bonus points for also auto-publishing to one or more keyservers on-change. For one example. Right now I have to locally export a key, import that into 1password as a text field, then have automation fetch the armored key before importing it into a local agent, etc. It's kind of a convoluted process compared to something like telling a package signing process to just use a local key agent which can just speak to 1password connect -- for another example. :) Git commit signing is technically on the list, but more of a side effect to me personally.

I think they're hoping everyone storing PGP keys is using them for signing commits and as people discover it can be done with SSH, they'll give up asking for the feature. There are indeed those of us from the '90s still using S/MIME and encrypting blocks to others who want 1Password to be the one stop secret shop.

Big +1 SSH commit signing is fine until you need to rotate keys. Revoking a GPG key will continue to show commits in GitHub (unsure about GitLab) as "verified (expired)". The only way I've found to do the same with SSH keys is to remove the old key completely, but then commits show as "unverified" which defeats the point of supply chain integrity since it's not possible to distinguish a commit that was signed with an old key, or a commit that was not signed, or signed with another key that's not allowed. The alternative is to not rotate signing keys, but then you compromise supply chain integrity further by not ensuring keys are rotated in a timely fashion.

Very interested in this as well.

Hey folks! Love to see the enthusiasm here and we are definitely evaluating this to add going forward 😄 Stay tuned!

GPG support? (like SSH) | 1Password Community

Ryan_Parman
Dedicated Contributor
2 years ago
I started watching this issue 15 months ago, shortly after it was opened.

I use GPG for signing my Git commits

I use it for signing/encrypting emails

I use it with GoReleaser to generate GPG signatures for software packages I release

I use it with Keybase.io

I use it to encrypt new credentials for people who do not yet have a password manager, so that I can send them over Slack and email.

In the interim, I've been using GPG Tools (macOS) with pinentry-touchid for a reasonably modern GPG experience.
owenvoke
New Contributor
2 years ago
Would love to have support for GnuPG / PGP as well. Been using it for years for commit signing, file encryption / signatures, and for communication.
Former Member
2 years ago
GnuPG/PGP is almost entirely different from SSH. Having one does not make up for not having the other. The whole point of 1password is to support all of these different tools in one system. Please stop distracting with SSH and just implement similar GnuPG support.
kherge
New Contributor
2 years ago
After having the pleasure of using 1Password's SSH agent, I am also very excited about the possibility of using my GnuPG keys with 1Password and a GnuPG agent. SSH is nice, but I value GnuPG's sub keys support greatly.

I generally manage my identity with GnuPG keys, not SSH keys.

It's already been mentioned, but key servers for verification is great.

The ability to publish and revoke these keys.

Being able to create distinct sub keys allows me to avoid using a master key.

I can sign for things using dedicated signing keys.

I can encrypt things using dedicated encryption keys.

From what I understand, if you wanted any of this without GnuPG you would have to use certificates and certificate authorities.
Nezteb
New Contributor
2 years ago
Chiming in to echo that I'd love GPG support!
Former Member
2 years ago
+1 for this. Even with SSH signing I'd love GPG support for email among other things. It would beat adding my key as a file.
Jack_P_1P
1Password Team
2 years ago
Thanks for your feedback ionos!

Jack
ionos
Occasional Contributor
2 years ago
floris_1P

top of my head:

key servers for verification, web of trust (an SSH commit signature by itself means nothing, if I don't know the key)

existing workflows based on GPG

subkeys
floris_1P
1Password Team
2 years ago
What are the benefits you're seeing of using GPG over SSH for commit signing?
- jau
  New Contributor
  24 days ago
  GPG keys exist in a web of trust outside of the specific platform that I am using to host my code.
Former Member
2 years ago
I would love to see support for GPG!

As previously stated by some, I use GPG for signing commits with GIT (I also prefer it over SSH keys).