- Add make_ping_key_revocation.py: onion revocations are signed by the
identity key, DNS TXT revocations are self-signed by the revoked key
- Document the revocation format, endpoint, helper usage, lifetime and
no-revocation-of-identity-key limits
- Update the security audit, references and env docs for the new flow and
the v2/onion-only scope
- Correct WELIST_ALLOW_LEGACY_PING: legacy pings are accepted by default,
the flag only disables them.
- Describe onion delegation: v2-only inclusion, service-side host
normalization, strict expiry check, deployment order and rollback.
- Warn that disabled delegation rejects onion pings when SSL_KEY_PATH is
the dedicated ping key.
- Document certificate lifetime and revocation limits, offline master
key requirements, helper --days bounds, and a delegation verification
checklist.
- Fix the bal-pusher.sh comment about the service-side defaults.
- Add contrib/make_welist_txt.sh to print the _welist-key TXT
name, value and BIND zone line for a domain and Ed25519 key
- Accept a private/public PEM file or an existing base64 SPKI DER
- Generate private_key.pem and public_key.pem when the key argument
is omitted, reusing an existing private key
- Document the helper in docs/10_dnssec_key_publishing.md
- Load WELIST_PING_DELEGATION_FILE into a typed OnionDelegation
- Send the certificate only with v2 pings for onion hosts
- Validate the onion host, expiry and delegated key against
BAL_SERVER_URL and SSL_KEY_PATH at startup; disable delegation
with a warning on any mismatch
- Stop sending unsigned info/base_fee/version with v1 pings so
v1 remains liveness-only
- Document v1/v2 metadata handling and onion delegation implications
- Add contrib/make_onion_delegation.py to issue certificates offline,
with Ed25519 key validation and clean CLI error handling
