# Test-only PGP fixtures (ITISSUES-4572)

These are **throwaway keypairs generated solely for this test suite** — never real Paynetics or
Google keys, no real key material, safe to commit.

- `paynetics-signing-keys.TEST-ONLY.asc` — 2 armored RSA-3072 **private** keys, playing "our" Google
  OPC signing keys (rotation window). Used as `GOOGLE_OPC_SIGNING_KEYS` in `.env.test`.
- `google-public-keys.TEST-ONLY.asc` — the matching 2 **public** keys, playing "Google's" encryption
  keys. Used as `GOOGLE_OPC_ENCRYPTION_KEYS` in `.env.test`.
- `paynetics-public-keys.TEST-ONLY.asc` — public half of the signing keys, so tests can verify our
  signature ("Google" would use this to register/verify).
- `google-private-keys.TEST-ONLY.asc` — private half of the encryption keys, so tests can decrypt the
  produced blob ("Google" would hold these).

Regenerate with GnuPG (`brew install gnupg`) if the fixtures ever need to change:

```bash
gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key "<name> <email>" rsa3072 default never
# for the two encryption ("Google") keys, also add an encryption subkey:
gpg --batch --pinentry-mode loopback --passphrase '' --quick-add-key <fingerprint> rsa3072 encr never
```

No passphrase, no expiry — these only need to exist long enough to prove the crypto plumbing works.