Improve email encryption

[marcoieni]

Discussed in #t-infra > meeting 2026-02-09

Right now we use a symmetric key to encrypt emails, this means that an infra admin needs to encrypt the email for the contributors.
We want to use public key to allow people to self-serve and improve transparency in the process.

Tasks:

• Create a pair of public/private key
• hardcode the public key in the sync-team program
• Save the private key in the github actions secrets
• create a team command to encrypt the e-mail
• An infra admin should decrypt all emails encrypted with the symmetric key and re-encrypt them using the public key
• Decrypt the emails in CI

[programmerjake]

• Contact the people who encrypted their emails to encrypt them with the new method

couldn't someone with access to the symmetric key just re-encrypt them all with the public key? seems like that would work better than having to contact all of them.

[ubiratansoares]

:couldn't someone with access to the symmetric key just re-encrypt them all with the public key? seems like that would work better than having to contact all of them.

That's definetly an option, especially considering that we don't have too many encrypted emails so far (only three, afaik) 🙂

[marcoieni]

couldn't someone with access to the symmetric key just re-encrypt them all with the public key? seems like that would work better than having to contact all of them.

Yes, makes sense. Thanks! I updated the task list 👍

[Carbonhell]

I'll take care of the code changes needed to support this :)