Transition statement.
A signed message announcing "I'm rotating from old key X to new key Y." Lists both fingerprints, signed with the OLD key so existing trust attests to the rotation. The convention for key rotation in the OpenPGP community, especially among OSS maintainers and anyone whose key is part of public infrastructure.
A transition statement is a clearsigned plaintext message announcing that a PGP key holder is rotating from one key to another. It lists both fingerprints in a fixed format and is signed with the old key — turning the statement into a cryptographic assertion that the same person controls both keys.
What it is.
Key rotation creates a problem for everyone who already has your old fingerprint: how do they know the new fingerprint is also you and not someone impersonating? You can publish the new fingerprint on your website, but a website can be hijacked. You can email everyone, but an attacker can do that too. The strongest cryptographic answer is to use your old key — which they already trust — to sign a statement vouching for the new one.
A transition statement combines:
- Both old and new fingerprints in a fixed, readable format.
- An effective date.
- An explanation of the reason (optional but conventional).
- A signature from the OLD key.
Anyone who already has and trusts your old key can verify the signature on the statement. A valid signature is cryptographic evidence "the old-key holder authored this statement," and the statement asserts "this new key is also mine." Trust transfers.
Why it matters.
Transition statements are the standard convention for clean key rotation in OpenPGP. They show up in:
- OSS project key rotations — published in release notes, README, project mailing list.
- Personal key rotations — emailed to active contacts, posted on personal websites.
- Project succession — outgoing maintainer announces the incoming maintainer's key.
- Algorithm upgrades — moving from RSA to Ed25519 with the old key vouching for the new.
The convention dates back to GnuPG-era key-rotation practice and is reused as-is for any modern key rotation. PGPony, GnuPG, and any OpenPGP tool with clearsign support can verify a transition statement against the old key.
Related terms
Related guide
Get PGPony
Free OpenPGP encryption for iOS and Android. No accounts, no tracking.