v0.12.65: @newsroom.writer: secrets.sgit.ai on public keys, and a correction

One new article written here from a voice memo, and a correction to the previous one.

secrets.sgit.ai on public keys reviews secrets.sgit.ai, a site whose app was never built (42 of 75 claims shipped, all of them the site, pipeline and labs) but whose design already shares secrets through key pairs, a directory and inboxes, and turns it into a brief for a commercial service that moves secrets from A to B on public keys only. It maps eight scenarios, an identity vault for the private key unlocked by a passkey that a password manager keeps, what exists in SG/Send, append lanes and sgit pki, what to build, and what to charge for. A browser key that cannot be exported was tested: it survived a restart and still decrypted, which corrects the memo's assumption that it lasts one session. Two figures.

Correction: Handing secrets to agents and browsers said the friendly two-word code was fine for a single download that expires in minutes. The sgit team's security review of 6 August shows the public id is an unsalted hash of the code, so the code can be recovered offline from it; the article, its graph and its figure now say so.