013 — DKIM rotation on claim transfer

Context

Each user_domain stores a DKIM keypair (public + encrypted private). After a claim transfer, the previous owner must not retain usable signing material for the hostname.

Decision

On successful claim transfer, generate a new DKIM keypair for the claimant in the same atomic D1 batch that revokes the incumbent and verifies the claimant.

Consequences

• Transfer and key rotation cannot partially succeed relative to each other.
• Previous owner's encrypted private key on the revoked row is irrelevant for future sending under the new owner.