[overheadhunter]

as suggested in #29 (comment):

The user's private signer key is used to sign the public keys of trusted users.

also changed the shape of the "account key" and "vault recovery key", denoting that they are a potentially long-living "paper key".

flowchart TB
    subgraph keystore["Device keystore — locked/unlocked outside Katta"]
        devkey["Private Device Key<br/>Public Device Key"]
    end

    userkeys["Private User Key<br/>Private Signer Key"]
    accoukey["Account Key"]@{shape: paper-tape}
    membekey["Vault Member Key"]
    recovkey["Private Vault Recovery Key"]@{shape: paper-tape}
    trusted["Public Keys<br/>of trusted users"]@{shape: procs}
    uvf["vault.uvf payload<br/><i>Katta Server and S3 bucket</i>"]

    devkey -- decrypts --> userkeys
    accoukey -- decrypts --> userkeys
    userkeys -- decrypts --> accoukey
    userkeys -- decrypts --> membekey
    userkeys -- decrypts --> recovkey
    userkeys -- signs --> trusted
    membekey -- decrypts --> uvf
    recovkey -- decrypts --> uvf

Loading

[Copilot]

🟢 Approval recommended

The changes are limited to a documentation diagram, with only a minor legend correction remaining.

1 open issue

• Update legend to describe the Account Key paper-tape shape · New

What changed in this PR

Updates the security architecture’s Keys diagram to clarify signing relationships and visually distinguish key types.

Changes:

• Corrects the trusted-public-key relationship from “decrypts” to “signs.”
• Simplifies trusted-key terminology and adds shapes for the Account Key and trusted public keys.
• Removes the dashed-border styling.

File	Description
docs/​architecture/​security.md	Updates terminology, relationships, and styling in the Keys diagram.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The legend still describes dashed borders that the updated diagram no longer uses.

1 open issue

• Update legend to describe the Account Key paper-tape shape

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The focused documentation changes match the stated intent, resolve the prior legend feedback, and have no identified blocking issues.

No open issues 🎉

1 resolved since last review

• Update legend to describe the Account Key paper-tape shape

_{Review effort: Balanced}