# Rotation of the signing keys for zcashd, Zallet, and standalone Android binaries for Zodl

**URL:** <https://forum.zcashcommunity.com/t/rotation-of-the-signing-keys-for-zcashd-zallet-and-standalone-android-binaries-for-zodl/55144>\
**Category:** Ecosystem Updates\
**Created:** [March 30, 2026, 10:52am UTC](https://forum.zcashcommunity.com/t/rotation-of-the-signing-keys-for-zcashd-zallet-and-standalone-android-binaries-for-zodl/55144 "2026-03-30T10:52:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![daira](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/daira/32/43253_2.png) [@daira](https://forum.zcashcommunity.com/u/daira)\
**Post date:** [March 30, 2026, 10:52am UTC](https://forum.zcashcommunity.com/t/rotation-of-the-signing-keys-for-zcashd-zallet-and-standalone-android-binaries-for-zodl/55144/1 "2026-03-30T10:52:47Z")

</div>

A copy of this statement clear-signed with both the old and new keys is available at [https://zodl.com/security/key-transition.txt.asc](https://zodl.com/security/key-transition.txt.asc) .

```auto
GPG Key Transition Statement

We are transitioning the GPG signing key used to sign zcashd and Zallet APT packages,
as well as standalone Android binaries (GitHub Releases for zodl-inc/zodl-android).
This transition reflects the reorganization of the project under Zcash Open Development
Lab (ZODL).

Old key (Electric Coin Company):

Fingerprint : B1C9 095E AA18 48DB B54D 9DDA 1D05 FDC6 6B37 2CFE
UID : Zcash Master Signing Key (Electric Coin Company) <sysadmin@z.cash>
Key type : RSA 3072-bit
Created : 2023-06-19
Status : To be revoked as a precaution after a transition period
Public key : https://apt.z.cash/zcash.asc

New key (Zcash Open Development Lab):

Fingerprint : 0338 34DD 49DE CF9D BB99 34BC 6C93 CA8E 58E2 6AB1
UID : Zcash Open Development Lab (ZODL) (Dallas, Texas) <sysadmin@zodl.com>
Key type : RSA 4096-bit
Expires : 2028-03-22
Public key : https://apt.z.cash/zodl.asc

Timeline:

2026-03-23 New key generated.
2026-03-27 This announcement is published.
2026-04-23 All new zcashd and Zallet packages and binaries will be signed exclusively
            with the new key. Packages signed with the old key will no longer be
            published.
2026-06-23 Planned revocation of old ECC key.

Action required for Zcashd APT users:

If you run zcashd via the apt.z.cash repository, you MUST add the new signing key before
2026-04-23 or apt-get upgrade will fail with a signature verification error and zcashd
will stop receiving updates.

Step 1 — Import the new key:
    curl -fsSL https://apt.z.cash/zodl.asc | \
      sudo gpg --dearmor -o /usr/share/keyrings/zcash-zodl-archive-keyring.gpg

Step 2 — Update your sources file.
  Edit /etc/apt/sources.list.d/zcash.list and change the signed-by path:

    deb [signed-by=/usr/share/keyrings/zcash-zodl-archive-keyring.gpg] \
      https://apt.z.cash/ <distro> main

  (Replace <distro> with your distribution, e.g. bookworm.)

Step 3 — Verify the update works:

    sudo apt-get update && sudo apt-get install --dry-run zcashd

After 2026-04-23 the old key (sysadmin@z.cash) will no longer sign new releases.
Packages already installed are not affected; only future upgrades require the new key.

Action required for Zallet APT users:

Same procedure as above. Update your /etc/apt/sources.list.d/zallet.list:

    deb [signed-by=/usr/share/keyrings/zcash-zodl-archive-keyring.gpg] \
      https://apt.z.cash/ <distro> main

Action required for zodl-android (APK) users:

Android APKs published to GitHub Releases at
https://github.com/zodl-inc/zodl-android will be signed with the new key
starting 2026-04-23. To verify a release binary:

    curl -fsSL https://apt.z.cash/zodl.asc | gpg --import
    gpg --verify zodl-android-<version>.apk.asc zodl-android-<version>.apk

Verification:

This document is signed with both the old key (sysadmin@z.cash) and the new key
(sysadmin@zodl.com) to establish continuity of identity. To verify:

    curl -fsSL https://zodl.com/security/key-transition.txt.asc >key-transition.txt.asc
    gpg --verify key-transition.txt.asc

and then verify that key-transition.txt.asc matches the published announcement.

```

(Apologies for the long lines; I didn’t want to change the formatting from what was signed. You can click “⤢” on the top-right of the text block to see it without needing to scroll left and right.)