Custodians and the community key

A community has its own identity and its own key, separate from any member's. The custodians hold that key: they can sign for the community, turn its features on and off, and add or remove other custodians. Whoever creates a community is its first custodian, its founder.

Every custodian holds a whole copy of the community key, sealed so only they can open it.

A whole key each, not pieces

Each custodian gets a complete copy of the community key, sealed to them alone: no one else, not even the relay that stores it, can open it. The key isn't split between custodians, so any one of them can act for the community on their own, and the community survives any one of them losing a phone.

That's why the app asks for a second custodian as soon as possible: a trusted person with their own device. Some features, such as storage, can't be turned on until there are two. And since any custodian can act alone, choose people you trust; the other custodians can always protest a feature change.

Custodians are listed under Members → Custodians.

When people come and go

1Add a custodian2A custodian leaves3Move to a new key4Someone is gone for good5Sign the handover6After the waiting period

1. Add a custodian
2. A custodian leaves
3. Move to a new key
4. Someone is gone for good
5. Sign the handover
6. After the waiting period

1. Add a custodian. A custodian makes another member a custodian, and that person gets their own sealed copy of the key.
2. A custodian leaves. A custodian removes another (the last custodian can't be removed). A clan does this by vote instead, with a remove-custodian motion.
3. Move to a new key. Removing a custodian moves the community to a new key at once, sealed only to the custodians who remain. The person removed still has the old key, but it no longer speaks for the community. Clans and linked communities are told about the new key, with a proof signed by both the old and the new one.
4. Someone is gone for good. In a family community, the person who looked after part of the family tree may die or lose access for good. Another custodian starts an admin succession under Admin succession, naming who takes over.
5. Sign the handover. Every other custodian signs it. The former admin can cancel it, and their own device does so automatically if they're still using it.
6. After the waiting period. The handover takes effect 30 days after it started, once everyone has signed and no one has cancelled it.

When a member leaves

A member who leaves still knows the community's secret, so they could read what's written after they've gone. Under Members, a custodian can choose Move to a new secret: from then on, people who left can't read what's written next. What was written up to then stays readable to them. Removing a custodian does this automatically.