A self is its owner key: an Ed25519 key in ~/.ledgdex/NAME.key. The file has mode 600. Ledgdex refuses a key file that other users can read.
The owner key signs messages to other ledgers. It also signs the types that only the owner can sign: device, device_revoke, rotate, and recover in a root.
A device key lets a phone, a till or a robot sign everyday entries without the owner key. Examples are offers, records and deliveries:
PUB=$(ledgdex keygen phone) # on the phone
ledgdex device add shop "$PUB" --name "shop phone" # with the owner key
ledgdex device revoke shop "$PUB" --reason lostA revoked device cannot sign more entries. The entries that it signed before stay valid.
Give device keys only to devices that you trust with the ledger. A revoke cannot undo what a stolen device could sign while it was active.
To replace the owner key, rotate it. The old key signs the rotation: ledgdex rotate biobot --key biobot-2027.
If the owner loses the owner key, use recovery:
1. The root operator checks who the owner is.
2. The root names a new key for the ledger.
3. The owner gets the ledger again with the new key.
A recovery removes all device keys.
NEW=$(ledgdex keygen biobot-new) # owner, on a new computer
ledgdex recover exchange https://biobot.example "$NEW" # root operator, with the owner key of the root
ledgdex recovered biobot --root https://exchange.example --key biobot-newKeep a backup of each owner key offline. Example: Keys runs all of these steps.