PGP ID, in a nutshell

PGP ID is a digital identity that is:

• universal — characterises all persons of the solar system: physical (humans), legal (organisations), even digital (AI agents);
• decentralised — no central authority, no third-party identity provider, no cloud vault to trust ;
• respectful — built on the strongest encryption primitives we have, so as to protect your privacy as fully as possible;
• interoperable — usable anywhere OpenPGP is accepted (email signing and encryption, document signing, SSH authentication, supply-chain traceability, git, …);
• sovereign — your private keys are yours, on a physical security key (YubiKey / NitroKey) you hold in your hand;
• long-lived — your EID (Entity IDentifier, see below) is stable for life; the certificates that back it can be rotated (post-quantum migration, etc.) without changing who you are.

Since January 2026 , PGP ID is in production, shipped in the Djibian GNU/Linux operating system.

The EID, your entity identifier

Under the hood, your PGP ID is anchored in an EID (Entity IDentifier): a deterministic identifier, computed once and for all from your birth civil records (u4 variant) or from a moment and place of origin (u5 variant) — for instance urn:eid:u4vb6UZTMKsllgoH760pc0xwe_42.17-002.76. Anyone who knows that origin data can recompute and verify your EID, without any central registry. It precedes your cryptographic keys and outlives them: certificates get renewed, the EID remains.

🔎 Digging deeper: the technical article details how EIDs are built, and the RFC draft draft-foopgp-urn-eid-00 specifies the eid URN namespace, meant to be reserved with IANA.

What is a sovereign digital identity good for?

In practice, your PGP ID lets you:

• Authenticate without passwords on online services — including on any remote Djibian machine , without ever placing a private key on it.
• Sign your documents, emails, commits, contracts — non-repudiable proof of origin.
• Encrypt your exchanges and personal data, i.e. keep them private.
• Certify the people close to you and weave your web of trust .
• Stop being subjected to identity theft, informational pollution , or generative-AI misuse.

And more broadly, a step toward abolishing certain privileges , and gaining more freedom, equality, fraternity. ✊🕊️💕

Giving birth to your PGP ID

On a Djibian system, the Djibian Onboarding graphical frontend guides the creation of an OpenPGP identity in about a dozen clicks:

1. Launch Djibian Onboarding (menu Applications → Accessories).
2. Choose « Configure your OpenPGP security key ».
3. Insert your YubiKey or NitroKey — it is detected automatically.
4. First time? « Create my OpenPGP identity ».
5. Fill in birth name, given names, date of birth, country of birth, email.
6. Verify the information.
7. Print the QR codes (at least three sheets — see below).
8. Scan the QR codes — the key is etched into your YubiKey/NitroKey.
9. Done: your PGP ID is born.

Everything offline, no third-party server call. Video demo in the release article .

Backup: paper QR codes, secret sharing

The foopgp tools generate and print your private keys as paper fragments, encrypted and split using a secret sharing (Shamir) scheme: by default, 3 fragments out of 5 printed are enough to reconstitute the key.

Fragment 1/5	Fragment 2/5	Fragment 5/5

A few properties to know:

• No isolated fragment reveals anything — you need the quorum (3 here) to reconstitute.
• Offline by construction: fragments live on paper only, never on a cloud, never on a connected disk.
• Resilience: losing one or two fragments is not fatal; losing your YubiKey is not either, as long as you have your quorum of fragments.
• Entrusting fragments to people you trust is a common strategy: one fragment with a relative, one with a friend, one in a safe — and impersonation becomes very hard.

Transposing to a physical key

Once your private keys have been fragmented onto paper sheets, another foopgp tool reads the QR codes via a webcam or scanner and etches the keys into a YubiKey or a NitroKey. The private keys never touch a hard drive nor a third-party service.

From there, your identity is exercised from your hand on any OpenPGP-compatible service: sign , decrypt , authenticate — the PGP ID physical key protects your privacy and your human singularity in the digital world.

Here is the Djibian Onboarding welcome screen once your key is set up — avatar, common name, PGP ID identifier and emails read straight from the plugged-in physical key:

Illustration. Photograph of Phil Zimmermann , inventor of PGP — Wikimedia Commons , CC BY-SA 3.0.

In short

PGP ID makes real digital sovereignty possible: no password to forget, no cloud vault to trust, no dependence on an external identity provider. An identity that is yours, anchored in a physical object you carry, and usable everywhere.

While others sell you technologies that enslave you, foopgp enables everyone to embrace technologies that serve us. Safer, leaner, and entirely sovereign.