July 2020
<p/>
Personal Web sites have passed their sell-by date. This site is no longer maintained.

<hr/>

Aug 2025
<p/>

If you wish to contact me via secure means, I use OpenPGP with <a href="mailto:mail@raylau.com">email</a>. I used to use S/MIME but it seems like more folks use OpenPGP because of Proton and Thunderbird support.

<p/>
My current GnuPG Key is key id 2EEA454EFF5AB10A and can be found at the following semi-trustworthy sources:

<ul>
  <li>as a DANE record in DNS (protected by DNSSEC), i.e..<br/><tt>gpg --auto-key-locate dane --locate-keys mail@raylau.com</tt><br/>
<br/>or to verify the fingerprint direct from DNS: <pre>

# verify DNSSEC
% delv OPENPGPKEY `echo -n "mail" | sha256sum | head -c56`._openpgpkey.raylau.com.                                                             
; fully validated
00d8d3f11739d2f3537099982b4674c29fc59a8fda350fca1379613a._openpgpkey.raylau.com. 2779 IN OPENPGPKEY mDMEaKDq8BYJKwYBBAHaRw8BAQdALYjSOOfh+pgcO9qMUknZCTsdQIE2 D/YU4fm2IT8lEI20IFJheW1vbmQgTGF1KEcxKTxtYWlsQHJheWxhdS5j b20+iJkEExYKAEEWIQQzk0zEBHfVw3/E/Pku6kVO/1qxCgUCaKDq8AIb IwUJCWdS8wULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRAu6kVO /1qxCr//AQD/9km+7He1DbVUHD44rgDVAuUFj4E2/UvTRzys1UTBRQEA r5EI30j3mv29FwuivSk6uDccjpkvgRzP/uhHZCHRUg+4OARooOshEgor BgEEAZdVAQUBAQdAZtyOY+/bNQJrnTqQxPIhwIZAIfUNlLG/6/lJmGgt BhsDAQgHiH4EGBYKACYWIQQzk0zEBHfVw3/E/Pku6kVO/1qxCgUCaKDr IQIbDAUJCWdSwgAKCRAu6kVO/1qxCgucAP0VgRkghlbdSf/qax5ppbht ug+Yy7u4m5HPedrsJkNDmAEAwSQ7pG1R9B5SvncaJVX8pZhNsDm/v6ld Kp5CIo2gUQU=
00d8d3f11739d2f3537099982b4674c29fc59a8fda350fca1379613a._openpgpkey.raylau.com. 2779 IN RRSIG OPENPGPKEY 8 4 3600 20250831015954 20250817034416 20510 raylau.com. Sk53Bsj464nKjy6FnH7IvrrAlKfSbIwUVz5N83DZ5miGIcHEYHQVV7FM GESyHGgrVGUKMrDMTgEgYtmmPYN3X2jdfCivsniN2uenfKxVIGh3X5Q+ mVw5ZqXk6Z2I5CWC8lYdfL9/QLy2hPaRvuHLayc5+6Yj/l90HT8icIL0 4ALb++mlPnZ5u3UTSZMj7Ju8yKdG4ORWInKjbt5TtG6bU2XCRXqpQj4X 9tjJMle8yNgA3du5R1eRGQw+kVohzYAac/8dDAJsZYfJ8bkQX96mkt72 QH6IyeHc3z7ooqmyoZLCC+8h28ZE+4LYskJUYD5zS/UsffPB2RfbJhmm iUAdow==

# parse the key with gpg
% delv +short OPENPGPKEY `echo -n "mail" | sha256sum | head -c56`._openpgpkey.raylau.com. | base64 -d | gpg --import-options show-only --import
pub   ed25519 2025-08-16 [SCA] [expires: 2030-08-16]
      33934CC40477D5C37FC4FCF92EEA454EFF5AB10A
uid                      Raymond Lau(G1)&lt;mail@raylau.com&gt;
sub   cv25519 2025-08-16 [E] [expires: 2030-08-16]
</pre></li>
  <li>published here on my https server as a downloadable <a href="gpg/mail@raylau.com_G1.pub.asc">.asc file</a> and as a copy/paste text block:<br/>
    <pre>
Key ID: 2EEA454EFF5AB10A
Fingerprint : 33934CC40477D5C37FC4FCF92EEA454EFF5AB10A

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaKDq8BYJKwYBBAHaRw8BAQdALYjSOOfh+pgcO9qMUknZCTsdQIE2D/YU4fm2
IT8lEI20IFJheW1vbmQgTGF1KEcxKTxtYWlsQHJheWxhdS5jb20+iJkEExYKAEEW
IQQzk0zEBHfVw3/E/Pku6kVO/1qxCgUCaKDq8AIbIwUJCWdS8wULCQgHAgIiAgYV
CgkICwIEFgIDAQIeBwIXgAAKCRAu6kVO/1qxCr//AQD/9km+7He1DbVUHD44rgDV
AuUFj4E2/UvTRzys1UTBRQEAr5EI30j3mv29FwuivSk6uDccjpkvgRzP/uhHZCHR
Ug+4OARooOshEgorBgEEAZdVAQUBAQdAZtyOY+/bNQJrnTqQxPIhwIZAIfUNlLG/
6/lJmGgtBhsDAQgHiH4EGBYKACYWIQQzk0zEBHfVw3/E/Pku6kVO/1qxCgUCaKDr
IQIbDAUJCWdSwgAKCRAu6kVO/1qxCgucAP0VgRkghlbdSf/qax5ppbhtug+Yy7u4
m5HPedrsJkNDmAEAwSQ7pG1R9B5SvncaJVX8pZhNsDm/v6ldKp5CIo2gUQU=
=8U5j
-----END PGP PUBLIC KEY BLOCK-----
</pre>
  </li>
  <li>published to the WKD URI, i.e.<br/><tt>gpg --location-keys mail@raylau.com</tt> will find it if wkd is enabled and<br/><tt>gpg-wks-client --check -v --debug=ipc mail@raylau.com</tt> will also report that the key can be found.</li>
  <li>published here in a <a href="gpg/G1AttestationDocusign.pdf">DocuSign'ed envelope</a>
</ul>

There is an older 1999 key id 9C1CB36C24CE13B8 floating around some keyservers from an older version of Thunderbird that did not let me export keys. Please do not use that key as it was lost when I stopped using Thunderbird. (And back then, keys did not let you specify expirations.) In any case, the modern keys.opengpg.org server is the only one that at least does some validation of the submitter, so I do not recommend basing trust on a keyserver.