pgp_keys

Create a new PGP key. Body: {label, key_value}.

Soft-delete a PGP key.

Fetch a single PGP key (no key_value).

List active PGP keys (no key_value, no deleted rows).

Picker shape: id + label (+ is_expired) only -- no fingerprint, audit fields, or key material.

Code
Exposure: session auth only. There is deliberately NO permission decorator
here (PR decision #9), so ANY authenticated user -- not just report editors
-- can enumerate key ids and labels. There is no report-edit permission to
gate on: the report list loads this picker on every render for every user,
so gating it behind britecore/pgp-keys would 403 the report list for
everyone without the admin permission and lock report editors out of
configuring encryption. Labels are operator-chosen names ("ACME nightly
export"), so the accepted leak is a list of counterparty names; the
material that matters -- key_value and fingerprint -- is never in this
payload and stays behind the admin endpoints (list/get/create/update/
delete/preview), which all require britecore/pgp-keys.

Parse a pasted armored block and return just the fingerprint without saving. Used by the admin editor to surface the fingerprint live so admins can verify against the value the counterparty gave them before clicking Save. Body: {key_value}. Response: {fingerprint}.

Rename and/or rotate a PGP key. Body: {id, label, key_value?}.

Code
Empty / missing key_value -> label-only update. Non-empty key_value ->
rotation: re-validates and recomputes fingerprint while preserving the
row id so reports referencing this key keep working.