Containing lateral movement of a compromised machine is hard

Before doing anything else , consider if you actually need to expose anything to the internet at all. Running a VPN would let you reduce your exposed service to 1 port ( wireguard is UDP based so it’s harder to test if the port is open too ). A VPN like NetBird / tailscale / Cloudflare warp don’t need you to open any ports at all

Except for services that absolutely must be open to the internet ( like my Tor Relay ) I access everything via NetBird

I appreciate you taking the time to implement this and answering some questions! I have a follow up question- What’s the benefit of using asymmetric encryption here? You’re not signing the message ( you probably should imo ) and you don’t appear to support sharing encrypted notes ( i.e a user provides one or more additional public keys that a note is encrypted for ). You’re basically doing symmetric encryption with the pain of key management

It’d be simpler ( from a user and code perspective )to use symmetric encryption ( something like aes-256-gcm or ChaCha20-Poly1305 for example ) and use key wrapping to avoid encrypting user data directly and you’d have stronger crypto as a result

You’re right that PGP is a valid encryption method but it’s not very popular in the modern day because it’s very hard to get right. Latacora has a great post on the PGP Problemand the Soatok blogs that u/litchralee linked are well worth a read too

The CAB Forum only govern public CAs and certificates and the use of certs on the public internet. Your private PKI will be unaffected by the new changes. On top of that the change will be introduced gradually, the first reduction is in March 2026 and will limit certs issued after March 2026 to 200 days so even if you saw some impact for some reason you’d still have a couple of months to put a fix in place

Freshman need to accept the cert once (hopefully after checking the fingerprint)

Nobody is checking the fingerprint, nobody