Why publish a key?
A public OpenPGP key can support encrypted messages and signature verification. It does not prove the sender’s identity by itself. The fingerprint needs to be verified through an independent trusted channel.
What a complete key page needs
Publish the full fingerprint, key creation date, supported purpose, expiration policy and a clear update or revocation procedure. A short key identifier is not enough for a careful identity check.
Keep sensitive reports minimal
Before sending a security report, remove unrelated personal data and avoid publishing working exploit details into an unverified inbox. Include enough information to reproduce the issue safely and agree on a responsible disclosure process.
Current state
An official KoalaVPS PGP key and security contact have not been issued. Do not encrypt sensitive material to a key found elsewhere merely because it uses the KoalaVPS name.
Start with the support channel
Use Support and choose Security report for an initial enquiry about a verified contact method. Keep the first message limited to a description of the issue. A ticket is not an end-to-end encrypted PGP channel: wait until you have independently checked a published key and fingerprint before sharing material that needs that protection.
Verify the fingerprint outside the message
An encrypted message is useful only if it is addressed to the intended key. Compare the complete published fingerprint through a trusted independent path before sending sensitive material. A key identifier or an attachment inside an unexpected email is not sufficient verification.
Use a verified operator key
A verified KoalaVPS operator key is not provided on this page. Before sending an encrypted report, obtain the operator-controlled public key and verify its complete fingerprint. Its publication should include validity information, replacement history and the intended contact procedure.