Feature to delete individual keys from trust bundle

[keeganwitt]

There are cases where it might be useful to delete specific keys from the trust bundle. Some examples are

1. The private key was lost (maybe from a storage failure) and you want to reduce the size of the trust bundle.
2. Trust in the key has been revoked. For example, because the private key was leaked.

Currently, the only option offered is to delete the entire bundle.

[keeganwitt]

Another case (but a somewhat special case) would be if you decided to change your server config to use a lower TTL than you initially started with, then you're stuck with the keys already created.

[azdagron]

I believe this would be covered by the ongoing "Forced Rotation and Revocation" work that @MarcosDY has been working through.

[azdagron]

@keeganwitt just to clarify, you're talking about removing keys from the trust bundle from your own trust domain, not from a federated trust domain, correct?

[MarcosDY]

If it involves revoking a key within your own trust domain, this will be possible once force rotation becomes available.
Using:

• Revoke x509 authority
• Revoke x509 upstream authority
• Revoke JWT authoriry

[azdagron]

👋 hey @keeganwitt, friendly ping on answers to the question above :)

[keeganwitt]

@keeganwitt just to clarify, you're talking about removing keys from the trust bundle from your own trust domain, not from a federated trust domain, correct?

In our case, yes, nested not federated. But I'd think this would apply to federated setups too (but I'd have to read through the code a bit more on that).

If it involves revoking a key within your own trust domain, this will be possible once force rotation becomes available.
Using:

• Revoke x509 authority
• Revoke x509 upstream authority
• Revoke JWT authoriry

I think this would work, yes. I'm not sure if you were going to delete it from the bundle during revocation or set a revoked flag, but as long as it doesn't get included in the results served up by the OIDC endpoint, either way should work as far as this requirement.

[azdagron]

Yes, once it has been revoked, it will be removed from the bundle and not show up in the key set advertised by the OIDC discovery provider.