PGP Keychain
On-device OpenPGP keychain
Create, import, sign, and encrypt with OpenPGP keys that never leave Passport Prime, answering signing requests over QR. Keys can be derived from your seed, so a seed restore restores your PGP identity.
Last updated Jul 2026
Stored keys
Overview
PGP Keychain turns Passport Prime into a personal certificate authority that lives on secure hardware, offline. You can create keys, import existing ones, sign and encrypt files, and answer signing requests over nothing but QR codes, all on a device with no network stack and storage encrypted by your PIN. Keys are stored as armored files on Internal storage, and secret keys keep their own OpenPGP passphrase layer on top. There is no keyserver access and no background sync: key material only moves when you explicitly import or export it.
The standout is seed-derived identity. Alongside random RSA keys (2048, 3072, or 4096), the app can derive an Ed25519 key with an encryption subkey from the device master seed, and the same account number always re-creates the same key and fingerprint, on this device or a new one after a seed-phrase restore. Everything is built to match GnuPG output exactly: detached signatures identical to gpg --detach-sign, ciphertext that gpg -d reads, and a test suite that round-trips keys, signatures, and encrypted files through a real gpg to hold the compatibility line.
What it does
- Create keys: random RSA (2048/3072/4096) or an Ed25519 key with encryption subkey derived from the wallet master seed.
- Seed-derived keys are reproducible: the same account number re-creates the same key and fingerprint after a seed-phrase restore.
- Import armored .asc files (public or secret) from Internal, Airlock, or USB; RSA, DSA/ElGamal, ECDSA/ECDH, and Ed25519 all parse.
- Inspect and edit fingerprints, subkeys, user IDs, and expiration, with edits written as self-signature rebuilds that GnuPG verifies.
- Fully air-gapped QR signing: scan data with the camera (single or animated multi-part UR), approve on-screen, and the signature returns as a QR.
- Encrypt and decrypt files with output matching gpg -e and gpg -d, plus an optional embedded signature.
- Export public-only by default, with full secret export behind a danger confirmation.
Technical breakdown
How the proof-of-concept is built, for developers evaluating the platform.
Storage and passphrase layers
Keys live as armored files on Internal storage, on hardware a volume encrypted with PIN-derived keys, and secret keys keep their own OpenPGP passphrase layer on top. There is no keyserver access and no background sync, so key material only moves on explicit import or export.
Seed-derived PGP identity
The From seed option derives an Ed25519 key with an encryption subkey from the wallet master seed. The same account number always produces the same key and fingerprint, so restoring your seed phrase restores your PGP identity, on this device or a new one.
Air-gapped QR signing loop
Data comes in by camera as a single QR or an animated multi-part UR, you approve on-screen, and the signature goes out as a QR on the display. No cable is ever used, and the detached output matches gpg --detach-sign so it verifies anywhere.
Dig into the source
README, architecture notes, and the wire protocol live in the repo.