Key/cert rotation to facilitate pinning

It’s been suggested, for the work I’m doing on OpenKeychain as a Keybase client, that I pin the https connection to Keybase’s cert/key, for example see http://thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/ and https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning

This would allow sidestepping a bunch of potential stinky-CA-biz vulnerabilities and seems like a good idea to me in general; after all, I’m already compiling the base URI into the app code. But of course the problem is that this depends on working with Keybase’s key/cert rotation policy, if any, and in an open-source project where you can’t depend on someone being around to update the client. (Google’s policy, IIRC, was that they rotated the certs regularly but stayed with the same key.) My spidey-sense is also tingling, wondering if Keybase’s own infrastructure might be useful in making this easier and/or more secure.

If there’s something there already about keys/certs, I didn’t turn it up.

The issue names no files, tests, or concrete entry points. Start by investigating Keybase’s certificate and key rotation policy and the OpenKeychain client integration mentioned here; done would require an agreed, actionable rotation and pinning scope.

Written by the indexing model from the issue text.