{config, ...}:
{
  config = {
    gnupg = {
      enable = true;
      dir.var = toString ../../../sec/gnupg;
      keys = {
        "Commonsoft <root@commonsoft.org>" = {
          uid = "Commonsoft <root@commonsoft.org>";
          algo   = "rsa4096";
          expire = "3y";
          usage  = ["cert" "sign"];
          passPath = "commonsoft/gnupg/root@";
          subKeys = [
            { algo = "rsa4096"; expire = "3y"; usage = ["sign"];}
            { algo = "rsa4096"; expire = "3y"; usage = ["encrypt"];}
            { algo = "rsa4096"; expire = "3y"; usage = ["auth"];}
            ];
          #backupRecipients = ["@julm@autogeree.net"];
        };
      };
    };
  };
}