From 6fde319b2f84a20ea4f956c9d9025ded602fed88 Mon Sep 17 00:00:00 2001
From: mrhid6 <mrhid6@gmail.com>
Date: Fri, 24 Jul 2026 15:01:03 +0100
Subject: [PATCH] feat(license): trust the production signing key

---
 shared/license/keys.go | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/shared/license/keys.go b/shared/license/keys.go
index 5787946..5a76f44 100644
--- a/shared/license/keys.go
+++ b/shared/license/keys.go
@@ -20,9 +20,8 @@ import (
 // root is a licensing bypass: a self-hosted operator could point it at a keypair
 // they generated themselves.
 var trustedPublicKeys = []string{
-	// Populated in Task 6 with the real production key.
-	// Until then this slice is empty and every licence fails to verify,
-	// which is the correct default for a build with no trust root.
+	// Production signing key, generated 2026-07-24. Index 0 is current.
+	"AS6Z4XBXF7HPTOMBUK47SWHPROAGOSBIW5ZZZHTLCA6FHMYSHCCTV3S6AIN6DOB6VKMHMTLRIWPSBAZ2FOHJV3A6NLOCWGEO2VA7KYGSG62SILEFA4SNJ7VWDDIVZZM4ZU4VJVE22LESH72STAAVIDYI77WA====",
 }
 
 func publicKeys() ([]*lk.PublicKey, error) {