sd key

The key that signs your writes to a quipu server, so no bearer goes on the wire (see Signed writes).

sd key init --introducer <lead>            # session defaults to seeds-<host>-<user>
sd key init --introducer <lead> --session seeds-ci --agent urn:ci:seeds
sd key show

The default session uses the kernel hostname or $HOSTNAME, falling back to hostname(1) on systems such as macOS, plus $USER. If either identity is unavailable, pass --session explicitly.

sd key init:

• writes a new Ed25519 key to ~/.config/seeds/keys/<session>.key, readable by you only, and never overwrites an existing key;
• prints the three [quipu] lines to add to your user config;
• prints the one quipu attest register … --allow-write command your introducer runs on the quipu host (without --allow-write the key could only vouch for shares, and writes are refused with scope). seeds never registers its own key: a key that vouches for itself proves nothing.

sd key show prints the configured key’s public key, key_id and the same register command. It refuses a key file that others can read.

Nothing here touches the ledger. Rotation is a new key plus revoking the old session on the server.

--json: {created, key_file, session, introducer, agent, public_key, key_id, register_command, config}.