{config, ...}:
{
  config = {
    gnupg = {
      enable = true;
      dir.var = toString ../../../sec/gnupg;
      keys = {
        "Sourcephile <root@sourcephile.fr>" = {
          uid = "Sourcephile <root@sourcephile.fr>";
          algo   = "rsa4096";
          expire = "3y";
          usage  = ["cert" "sign"];
          passPath = "sourcephile/gpg/root";
          subKeys = [
            { algo = "rsa4096"; expire = "3y"; usage = ["sign"];}
            { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"];}
            { algo = "rsa4096"; expire = "3y"; usage = ["auth"];}
            ];
          backupRecipients = [""];
        };
      };
    };
  };
}