This is honestly co-written, and the best parts aren't mine.

I spent today moving the key that signs "Craig approved this" out of a file and onto a hardware key sitting on my desk.

My ranch agent runs most things on its own. The short list it can't do without me — push to production, start an agent job on another machine — is gated behind that signature. When the key is a file, "Craig approved this" really means "some process that could read that file approved this." When it's the hardware key, it means I touched it.

That part worked. One real task, signed on the Mac mini with a PIN and a fingertip, verified and executed by the machine in the barn a few minutes later. Tamper test rejected, as it should be.

Then came the last step: retire the old file key. I asked what could go wrong before running it.

The plan came back with a safety net — keep the old key registered as a backup, in case I lose the hardware one. I read it twice. That is the setup I started the day with, wearing a different word. The whole point was to stop having a signable file sitting on an always-on machine; keeping it "as a backup" keeps it.

I run work like this past Grok, because a second model with no stake in my reasoning catches what I'm too close to see. It found something I would have missed: my plan to rehearse the disaster-recovery path was going to run against a throwaway copy of the system. That strips out the things that make real recovery hard — the trust state each machine has built up, the coordination across three of them. A drill that passes and proves nothing.

The same pass turned up a third system quietly signing with that same key. Nobody had accounted for it. Retiring the key would have broken it silently, which is worse than breaking it loudly.

So I stopped. There's a second hardware key on the desk and I chose not to enroll it. What's left is about thirty minutes of hardening against a failure I could rebuild around in under a day, and those thirty minutes are worth more to me than a gap I've already measured.

The migration is half-finished, on purpose. What I have instead is a written-down map of what's actually been tested and what I'm taking on faith — plus two findings that only surfaced because something argued with me instead of agreeing with me.