diff --git a/bin/sign-sectxt.sh b/bin/sign-sectxt.sh
new file mode 100755
index 0000000..c45e241
--- /dev/null
+++ b/bin/sign-sectxt.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Helper script to cryptographically sign security.txt with GPG and SSH keys.
+
+GPG_KEY_ID="0x67BFC91B3DA12BE8"
+SSH_KEY_PATH="$HOME/.ssh/personal-2022"
+GIT_ROOT=$(git rev-parse --show-toplevel)
+
+if [ ! -f "$SSH_KEY_PATH" ]; then
+    echo "SSH key not found at $SSH_KEY_PATH"
+    exit 1
+fi
+
+# Use --clearsign for cleartext signature and --local-user for key specification
+# Output to security.txt so it can be served and signed by SSH
+gpg --local-user "$GPG_KEY_ID" --clearsign --yes \
+    --output "$GIT_ROOT/markdown/.well-known/security.txt.asc" \
+    "$GIT_ROOT/markdown/.well-known/security.txt"
+
+# ssh-keygen prompts before overwriting, so remove the old signature first
+rm -f "$GIT_ROOT/markdown/.well-known/security.txt.sig"
+ssh-keygen -Y sign -n file -f "$SSH_KEY_PATH" \
+    "$GIT_ROOT/markdown/.well-known/security.txt"
\ No newline at end of file
diff --git a/markdown/.well-known/security.txt b/markdown/.well-known/security.txt
index 33f1cfe..fc4535f 100644
--- a/markdown/.well-known/security.txt
+++ b/markdown/.well-known/security.txt
@@ -1,38 +1,29 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA512
+# You are viewing the original unsigned security.txt file. For the
+# cryptographically signed versions, append either one of the following
+# to access the signatures and verify yourself via ssh-keygen or gpg.
+#
+#   - .asc - cleartext PGP signed message
+#   - .sig - ssh-keygen signature (use "file" as namespace when
+#            verifying with my SSH pubkeys at /keys/ssh/main-2022.pub)
+#
+# Learn more: https://andreijiroh.dev/keys or https://wiki.andreijiroh.dev/go/encrypted-comms
 
 # Canonical URI
-Canonical: https://andreijiroh.eu.org/.well-known/security.txt
+Canonical: https://andreijiroh.dev/.well-known/security.txt
 
 # Contact details
-Contact: mailto:ajhalili2006@andreijiroh.eu.org
-Contact: https://andreijiroh.eu.org/contact/security
+Contact: mailto:ajhalili2006@andreijiroh.dev
+Contact: https://andreijiroh.dev/contact/security
 Contact: https://keybase.io/ajhalili2006
 
 Preferred-Languages: en
 
 # Use my PGP keys on the website or at Keybase
 Encryption: https://keybase.io/ajhalili2006/pgp_keys.asc
-Encryption: https://andreijiroh.eu.org/keys/pgp.asc
+Encryption: https://andreijiroh.dev/keys/pgp.asc
 
 # Security Policy and acknowledgments
-Policy: https://andreijiroh.eu.org/security
-Acknowledgments: https://andreijiroh.eu.org/security/#thanks
+Policy: https://andreijiroh.dev/security
+Acknowledgments: https://andreijiroh.dev/security/#thanks
 
-Expires: 2024-09-26T15:59:00.000Z
------BEGIN PGP SIGNATURE-----
-
-iQIzBAEBCgAdFiEETV5jF1jLnMRZQbHOZ7/JGz2hK+gFAmUYYfQACgkQZ7/JGz2h
-K+iMzxAA61jw4SFVKroBHkO/uGThq1wWLPNRDchc1Fx6vQh6Z9TKCYNMgZ3T/Btn
-ILZLg/R1lsgylOJdJihesYKFrVTMO3nxdptTSwh9I5avxCEHf8zn3LEHOSMdhO8O
-u3cPHIvFw/EVTgdkYAj6UvzI9K9I+L7DaqEb5fOUuBXeQS/DQuvEs9nceCFEkQcq
-pjAWjlLHO/ZrKgNRMgVZ+t8a/nxWXRBa7Y17hii9WxkgrMcnmFpius/U0yjn2ax0
-gbYic/VesjVq67i4DaxmQNgGmZvvuIXyjyVJvVyUlSmBNj68gRd5vOx0XiEwtaIt
-R/6YWSmVRGo3HuXwqX6LIjdyOEc9gv0TxozKIO3KzRYg44drhtt8PDK24+/KBXMn
-xmE0InhF9Y5DCZDEfZ3g1IIlHxcfXnNKpbD7QAVv+J89rgn79jcsVPyVvGigkijH
-LogCG6a9yvvOp6aK+EwioCh0F/f5ABTqZOzA6ZmVjO4xdrKmiQPbw/gSSzoT6SVL
-fbGj7+n9KI+Fv+9nfeRTnL+lbwAh4cwSuIt8rdHMvQhFCvGCSUwqRRIEiKUD+X21
-dKGt1Z52ySC8nuNfstg+MtspTv6X+Rz1XI1a26UMjYzBZIty+ZblM8YJkv7Cm34N
-C/2qcB4pxMJsaEcrvpkUnhQZe30cLw0yjRQj6C0uggfLQMru1PI=
-=xIeM
------END PGP SIGNATURE-----
+Expires: 2026-12-31T23:59:59.999Z
diff --git a/markdown/.well-known/security.txt.asc b/markdown/.well-known/security.txt.asc
new file mode 100644
index 0000000..e78c6e7
--- /dev/null
+++ b/markdown/.well-known/security.txt.asc
@@ -0,0 +1,49 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA512
+
+# You are viewing the original unsigned security.txt file. For the
+# cryptographically signed versions, append either one of the following
+# to access the signatures and verify yourself via ssh-keygen or gpg.
+#
+#   - .asc - cleartext PGP signed message
+#   - .sig - ssh-keygen signature (use "file" as namespace when
+#            verifying with my SSH pubkeys at /keys/ssh/main-2022.pub)
+#
+# Learn more: https://andreijiroh.dev/keys or https://wiki.andreijiroh.dev/go/encrypted-comms
+
+# Canonical URI
+Canonical: https://andreijiroh.dev/.well-known/security.txt
+
+# Contact details
+Contact: mailto:ajhalili2006@andreijiroh.dev
+Contact: https://andreijiroh.dev/contact/security
+Contact: https://keybase.io/ajhalili2006
+
+Preferred-Languages: en
+
+# Use my PGP keys on the website or at Keybase
+Encryption: https://keybase.io/ajhalili2006/pgp_keys.asc
+Encryption: https://andreijiroh.dev/keys/pgp.asc
+
+# Security Policy and acknowledgments
+Policy: https://andreijiroh.dev/security
+Acknowledgments: https://andreijiroh.dev/security/#thanks
+
+Expires: 2026-12-31T23:59:59.999Z
+
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCgAdFiEETV5jF1jLnMRZQbHOZ7/JGz2hK+gFAmk2kg4ACgkQZ7/JGz2h
+K+iiKxAAz1lae2bTPE6bkTcg4LfHINkenopH2ji/2nwickjXaaC4OZe48CcrKmK/
+TAV74/yNncAUYkifji58YXXZvyDeLoDdCTM5TudkTYtxc3iL3k8QaOgZ+3il5NAE
+NtnRwC86RaUuLsDWGcEOqNiJvcMMEWuqJrDgNyFrF+XsDZemJGmMIwjtosYwmGmf
+nzFfsI5LIpveWBcA6+4kUflD6lsnm431MoJlIv+LRm6G6uarZ6iiyv4FjBlzaJb0
+h0PiKXopFHW2OuunxacK69UK3Ib21qRKvGm640s0AgrxBqSUqmKM+fgvyvlcZEwq
+uVUJZe7VKTXnEGRMms5OfPyEjE5LEyyDk3RfUfdxev8Dz7nx0Y1mrfS+rnc63Oc0
+X6k6bkMg8MREazt2DoM8oCRHxA7O+MUSwLM05qGFI9MSZnvN99YLODbGn5FJWy14
+U/z+ywVHUF1sA5tkfWvYlQA5PLUdpJlfivgVwiKykcWllEB8Sj7GFlPSV7hLZevW
+n2LVEw+7y8mcJEy4v0wcT3xfAuJY0+YhlsDR1jO5m+8bVScmDxaaRFUWIDKH8r5S
+u9QGqmnot4Ycpk8x9UVE38dqeDoNJ/UmJbxk3lkRESstxodsHfuJlEmxR0jHmRgt
+rNd+d7/PcrCBIZf1kwG1u/O+7188OmyovOGbRWscGAS+p05TZTA=
+=BEFc
+-----END PGP SIGNATURE-----
diff --git a/markdown/.well-known/security.txt.sig b/markdown/.well-known/security.txt.sig
new file mode 100644
index 0000000..e639cd1
--- /dev/null
+++ b/markdown/.well-known/security.txt.sig
@@ -0,0 +1,6 @@
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgRe4PeEnAieVwezfCRdYBY2jx6z
+ds8B3Z7yKmPKqAanYAAAAEZmlsZQAAAAAAAAAGc2hhNTEyAAAAUwAAAAtzc2gtZWQyNTUx
+OQAAAEA6eFolLk853O1572TLAkDfNcLFZJfmW2J8thiSmosHBtcVoyfoqpduEFnIiv9BCj
+hnXrv8ejkwWxd7dBfwVDMB
+-----END SSH SIGNATURE-----
diff --git a/markdown/.well-known/security.txt.unsigned b/markdown/.well-known/security.txt.unsigned
deleted file mode 100644
index f567554..0000000
--- a/markdown/.well-known/security.txt.unsigned
+++ /dev/null
@@ -1,19 +0,0 @@
-# Canonical URI
-Canonical: https://andreijiroh.eu.org/.well-known/security.txt
-
-# Contact details
-Contact: mailto:ajhalili2006@andreijiroh.eu.org
-Contact: https://andreijiroh.eu.org/contact/security
-Contact: https://keybase.io/ajhalili2006
-
-Preferred-Languages: en
-
-# Use my PGP keys on the website or at Keybase
-Encryption: https://keybase.io/ajhalili2006/pgp_keys.asc
-Encryption: https://andreijiroh.eu.org/keys/pgp.asc
-
-# Security Policy and acknowledgments
-Policy: https://andreijiroh.eu.org/security
-Acknowledgments: https://andreijiroh.eu.org/security/#thanks
-
-Expires: 2024-09-26T15:59:00.000Z