SQ(1)

💖 sq-key-userid-revoke — SQ(1) 💖

okay bestie, pull up a chair, we're doing sq key userid revoke and it's lowkey the glow-up your key's been needing 🫶

---

✨ NAME ✨

sq-key-userid-revoke — revoke a user ID. yes, like, goodbye to that identity era 👋

---

🌸 SYNOPSIS 🌸

sq key userid revoke [OPTIONS]

---

🦋 DESCRIPTION 🦋

So. You're revoking a user ID. Periodt.

It creates a revocation certificate for a user ID. Very "this user ID is not the moment anymore" of it 💅

Here's the tea though: if you pass --revoker or --revoker-file, then that key is the one used to make the revocation certificate. And if that key is different from the certificate you're revoking? Congrats, you've just made a third-party revocation. Which is normally only useful if the owner of the certificate designated that key as a designated revoker. iykyk 🔑

For a user ID to get revoked, the certificate has to be valid under the current policy. Full stop. If the certificate is not valid under the current policy, consider revoking the whole certificate instead, or fix it with sq cert lint after verifying the certificate's integrity. And if the certificate is valid under the current policy but the specific user ID you want to revoke isn't? You can still revoke that user ID using --add-userid. slay, loophole queen 👑

Also, sq key userid revoke respects the reference time set by the top-level --time argument. When it's set, it uses that specified time instead of the current time to figure out what keys are valid, and it sets the revocation certificate's creation time to the reference time instead of the current time. time travel, but make it cryptography ⏰✨

---

🎀 OPTIONS 🎀

💜 Subcommand options 💜

• --add-email=EMAIL — use a user ID with the specified email address. The user ID is literally just the email address, nothing else. And ngl, the email address does not have to appear in a self-signed user ID.
• --add-userid=USERID — use the specified user ID. This one doesn't need to be self signed. But because using a user ID that's not self-signed is often a mistake, you gotta opt in explicitly with this option. consent is key, bestie ✋
• --allow-non-canonical-userids — don't reject new user IDs that aren't in canonical form. For the record, canonical user IDs are shaped like Name (Comment) <localpart@example.org>. if it's not giving that, this flag is your hall pass.
• --cert=FINGERPRINT|KEYID — revoke the user ID from the key with the specified fingerprint or key ID.
• --cert-email=EMAIL — revoke the user ID from the key where a user ID includes the specified email address.
• --cert-file=PATH — revoke the user ID from the key read from PATH.
• --cert-userid=USERID — revoke the user ID from the key with the specified user ID.
• --email=EMAIL — use a user ID consisting of just the email address, if the email address occurs in a self-signed user ID.
• --message=MESSAGE — a short, explanatory text. It gets shown to whoever views the revocation certificate, and it explains why the certificate has been revoked. Like, if Alice has left the organization, this is where you'd say who to contact instead. be normal about it, write a nice note ✉️
• --output=FILE — write to the specified FILE. If you don't specify it, and the certificate was read from the certificate store, then it imports the modified certificate into the cert store. And if you don't specify it, and the certificate was read from a file, it writes the modified certificate to stdout. defaults are doing the most, tbh.
• --reason=REASON — the reason for the revocation. If the reason happened in the past, you should say so using the --time argument. That way OpenPGP implementations can more accurately reason about artifacts whose validity depends on the validity of the user ID. Receipts matter 🧾

[possible values: retired, unspecified]

• --revoker=FINGERPRINT|KEYID — use the key with the specified fingerprint or key ID to create the revocation certificate. It signs the revocation certificate using the specified key. By default, the certificate being revoked is used. With this option, you can make a third-party revocation. plot twist ✨
• --revoker-email=EMAIL — use the key where a user ID includes the specified email address to create the revocation certificate. It signs the revocation certificate using the specified key. By default, the certificate being revoked is used. With this option, you can make a third-party revocation.
• --revoker-file=PATH — read the key from PATH to create the revocation certificate. It signs the revocation certificate using the specified key. By default, the certificate being revoked is used. With this option, you can make a third-party revocation.
• --revoker-userid=USERID — use the key with the specified user ID to create the revocation certificate. It signs the revocation certificate using the specified key. By default, the certificate being revoked is used. With this option, you can make a third-party revocation.
• --signature-notation NAME VALUE — add a notation to the signature. A user-defined notation's name must be of the form name@a.domain.you.control.org. If the notation's name starts with a !, then the notation is marked as being critical. And heads up: if a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. The notation is marked as being human readable. 🏷️
• --userid=USERID — use the specified self-signed user ID. The specified user ID must be self signed. no exceptions, it's giving strict.
• --userid-by-email=EMAIL — use the self-signed user ID with the specified email address.

🌈 Global options 🌈

See sq(1) for a description of the global options. (aka go read the main character's page, she explains everything 💅)

---

🌟 EXAMPLES 🌟

Retire a user ID on Alice's key. iconic exit, no notes:

sq key userid revoke --cert \
       EB28F26E2739A4870ECC47726F0073F60FD0CBF0 --userid \
       "Alice <alice@example.org>" --reason retired --message \
       "No longer at example.org."

---

👑 SEE ALSO 👑

sq(1), sq-key(1), sq-key-userid(1).

For the full documentation see <https://book.sequoia-pgp.org/>. go read it, fr fr 📚

---

⭐ VERSION ⭐

1.5.0

---

okay that's the whole page, you ate that 🍓 reminder that this is Sequoia PGP, version 1.5.0, all wrapped up as a User Commands page — mwah, go forth and revoke responsibly 💖🦋✨