StoredKey Class
One entry of the key ring: a private key the server minted, encrypted to the custodian's key-encryption key, plus the two facts needed to place it without opening it.
public sealed record StoredKey : System.IEquatable<Abblix.Jwt.ExternalKeys.StoredKey>Inheritance System.Object → StoredKey
Implements System.IEquatable<StoredKey>
Remarks
The entry is self-contained on purpose. Every pod derives the same state from the same set of entries with no coordination, and the only operation that ever needs synchronising is creating one, so an entry is written once and never updated. That is what keeps IKeyRingStore to an insert-if-absent and no CAS on update.
Properties
StoredKey.CreatedAt Property
When the key was minted, which decides when it starts signing: the active key is the newest one past
KeyRingOptions.KeyRolloverPropagation.
public System.DateTimeOffset CreatedAt { get; init; }Property Value
Remarks
Stored rather than derived from Id, though the period in the id implies it. The id is a coordinate on the rotation grid; this is the fact. Deriving it would let a change to the rotation interval silently reinterpret when existing keys were created.
StoredKey.Id Property
The entry's identity, and the token every pod races for: it is derived deterministically from the key's role, its algorithm and the rotation period, so all pods compute the same value and exactly one insert wins.
public string Id { get; init; }Property Value
StoredKey.Jwe Property
The envelope: the private JWK's JSON, encrypted to the KEK, in JWE compact serialization. Its header names
the KEK version that unwraps it (kid) and the algorithms used (alg, enc), so the entry
repeats none of that.
public string Jwe { get; init; }