DEFCON2TECH LLC
SECURITY & CRYPTOGRAPHIC TRUST POLICY

Version: 1.0
Effective date: September 4, 2026
Owner: DEFCON2TECH LLC
Review cycle: At least annually and following a key change, revocation, or material
change to the verification process

1. PURPOSE

This policy explains how external parties can verify digital signatures associated with
DEFCON2TECH communications and documents. It does not replace independent verification
of a key fingerprint through a separate trusted channel when elevated assurance is
needed.

2. PUBLIC SIGNING KEY

DEFCON2TECH publishes the following OpenPGP public key for signing and encrypted
communications:

Fingerprint:
28D3 0F0C 13D6 0050 5A6D 3EB1 6E27 5BDC E485 92A4

Key ID: 0x6E275BDCE48592A4

Identity: DefCon2Tech LLC. (DefCon2Tech Secure Communications.)
<secure@dc2tech.com>

Download: https://dc2tech.com/dc2tech-pubkey.asc

SHA-256:
8e7cc9f1cfe446d6facb4542b5f9f8aa1085a5ed4b48e71855264833a06b21ce

The canonical published copy and verification instructions are maintained at:
https://dc2tech.com/#verify

3. SIGNATURE VERIFICATION

For a document accompanied by an OpenPGP signature, first import the public key:

gpg --import dc2tech-pubkey.asc

Confirm that its fingerprint exactly matches the fingerprint in this policy through a
separate trusted channel when elevated assurance is required. Then verify:

gpg --verify DOCUMENT.sig DOCUMENT

A "Good signature" result from the matching key establishes that the signed bytes were
produced by the holder of the corresponding private key and have not changed since
signing. It does not establish the trustworthiness or suitability of the document's
content.

4. HIGH-ASSURANCE VERIFICATION

Before relying on a key for a material decision, compare the fingerprint above through
an independent, trusted channel. Contact DEFCON2TECH to arrange out-of-band
verification. Do not rely only on a key received in an unexpected email or attached
file.

5. ENCRYPTED COMMUNICATIONS

For sensitive first contact, email secure@dc2tech.com. Do not send secrets, passwords,
private keys, or sensitive client material through the public contact form. The
import and verify the published OpenPGP public key before encrypting sensitive
information:

gpg --encrypt --armor --recipient 0x6E275BDCE48592A4 MESSAGE

6. KEY CHANGE OR REVOCATION

If this signing key changes or is retired, DEFCON2TECH will update the canonical
verification page and this policy. If you suspect a key or signed communication has
been compromised, do not rely on it; report the concern to security@dc2tech.com and
request out-of-band verification.