@rapidmx/web-client 0.36.0 → 0.37.0

package/lib/contacts/useContactPhotoSrc.ts

@@ -2,10 +2,31 @@
 // Copyright (C) 2026 Jean-Philippe Steinmetz
 // SPDX-License-Identifier: MPL-2.0
 ///////////////////////////////////////////////////////////////////////////////
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import type { ApiClient } from "../util/api.js";
+import { getUnlockedKeys, subscribeKeySession } from "../crypto/keySession.js";
+import { openSealedBytes } from "../zeroAccess/sealedRecords.js";
 import { type Contact, contactPhotoUrl, fetchContactPhoto } from "./contactsApi.js";
 
+/** What a photo is fetched by: the contact's identity, and whether (and for which mailbox) it is sealed. */
+type PhotoContact = Pick<Contact, "uid" | "version" | "photoBlobKey"> & Partial<Pick<Contact, "mailboxUid" | "photoSealed">>;
+
+/** The cache identity of the global (cookie) client, for a sealed photo fetched without an explicit client. */
+const GLOBAL_CLIENT = {} as ApiClient;
+
+/** A contact's photo: the bytes as stored, or - sealed to the mailbox's zero-access key - opened (rejects when it can't be: initials show). */
+async function loadPhoto(contact: PhotoContact, client: ApiClient | undefined): Promise<Blob> {
+    const blob = await fetchContactPhoto(contact.uid, contact.version, client);
+    if (!contact.photoSealed) {
+        return blob;
+    }
+    const opened = await openSealedBytes(contact.mailboxUid ?? "", new Uint8Array(await blob.arrayBuffer()));
+    if (!opened) {
+        throw new Error("The contact's picture is protected and can't be opened here.");
+    }
+    return new Blob([opened as BlobPart]);
+}
+
 /** How many pictures stay loaded (as `blob:` URLs) after nothing shows them any more, so a list scrolled back over does not fetch them all again. */
 const CACHE_LIMIT = 50;
 
@@ -13,6 +34,8 @@ interface Entry {
     url: string;
     /** How many mounted avatars show this URL; it is never revoked while that is more than none. */
     refs: number;
+    /** A sealed picture's mailbox, whose keys opened it: dropped when that mailbox locks, shown or not, and never handed out while it is locked. */
+    mailboxUid?: string;
 }
 
 /** Least recently used first (a `Map` iterates in insertion order, and a use moves the entry to the end). */
@@ -22,6 +45,32 @@ const pending = new Map<string, { request: Promise<string>; waiters: number }>()
 const clientIds = new WeakMap<ApiClient, number>();
 let nextClientId = 0;
 
+let watchingKeys = false;
+
+/** A sealed picture opened with a mailbox's keys goes when that mailbox locks, like every other opened value (`sealedRecords.ts`): its URL
+ * is revoked even while an avatar shows it - each one drops it itself (`useContactPhoto()`). Subscribed with the first sealed picture. */
+function forgetOnLock(): void {
+    if (watchingKeys) {
+        return;
+    }
+    watchingKeys = true;
+    subscribeKeySession(({ mailboxUid, state }) => {
+        if (state === "locked") {
+            forgetSealed(mailboxUid);
+        }
+    });
+}
+
+/** Revokes and forgets `mailboxUid`'s sealed pictures. */
+function forgetSealed(mailboxUid: string): void {
+    for (const [key, entry] of entries) {
+        if (entry.mailboxUid === mailboxUid) {
+            URL.revokeObjectURL(entry.url);
+            entries.delete(key);
+        }
+    }
+}
+
 /** One key per picture of one account: the same uid never collides across the clients of a multi-account app, and a replaced picture (new version) is a new key. */
 function keyOf(client: ApiClient, uid: string, version: number): string {
     let id = clientIds.get(client);
@@ -75,8 +124,20 @@ function limited<T>(task: () => Promise<T>): Promise<T> {
     });
 }
 
-/** The `blob:` URL for `key`, fetched with `load` unless it is cached, and counted as shown until `release()`. Concurrent callers share one fetch. */
-async function acquire(key: string, load: () => Promise<Blob>): Promise<string> {
+/**
+ * The `blob:` URL for `key`, fetched with `load` unless it is cached, and counted as shown until `release()`. Concurrent callers share one fetch.
+ * `sealedMailboxUid` is a sealed picture's mailbox: opened only while it is unlocked, it is neither fetched, handed out from the cache nor
+ * stored once that mailbox is locked (rejects).
+ */
+async function acquire(key: string, load: () => Promise<Blob>, sealedMailboxUid?: string): Promise<string> {
+    if (sealedMailboxUid !== undefined) {
+        forgetOnLock();
+        if (!getUnlockedKeys(sealedMailboxUid)) {
+            // Not fetched either: it couldn't be opened, and the avatar retries it once the mailbox unlocks (`useContactPhoto()`).
+            forgetSealed(sealedMailboxUid);
+            throw new Error("The contact's mailbox is locked.");
+        }
+    }
     const entry = entries.get(key);
     if (entry) {
         entry.refs++;
@@ -90,9 +151,13 @@ async function acquire(key: string, load: () => Promise<Blob>): Promise<string>
             waiters: 0,
             request: limited(load)
                 .then((blob) => {
+                    // Opened just before a lock came: nothing opened is kept past it.
+                    if (sealedMailboxUid !== undefined && !getUnlockedKeys(sealedMailboxUid)) {
+                        throw new Error("The contact's mailbox locked while its picture was opened.");
+                    }
                     const url = URL.createObjectURL(blob);
                     // Claimed by everyone waiting from the start: an entry nobody holds yet could be trimmed before its avatar got to it.
-                    entries.set(key, { url, refs: created.waiters });
+                    entries.set(key, { url, refs: created.waiters, mailboxUid: sealedMailboxUid });
                     return url;
                 })
                 .finally(() => pending.delete(key)),
@@ -126,7 +191,7 @@ export function clearContactPhotoCache(): void {
  * token-authenticated client (the desktop and mobile apps) cannot do that - an `<img>` sends no `Authorization` header - so the picture is fetched through the client
  * and shown as a `blob:` URL, cached per client, contact and version with a small LRU and revoked once it falls out of it and nothing shows it.
  */
-export function useContactPhotoSrc(contact: Pick<Contact, "uid" | "version" | "photoBlobKey"> | undefined, client?: ApiClient): string | undefined {
+export function useContactPhotoSrc(contact: PhotoContact | undefined, client?: ApiClient): string | undefined {
     return useContactPhoto(contact, client).src;
 }
 
@@ -135,23 +200,48 @@ export function useContactPhotoSrc(contact: Pick<Contact, "uid" | "version" | "p
  * that is not on screen yet has no reason to fetch its picture.
  */
 export function useContactPhoto(
-    contact: Pick<Contact, "uid" | "version" | "photoBlobKey"> | undefined,
+    contact: PhotoContact | undefined,
     client?: ApiClient,
     active = true,
 ): { src: string | undefined; failed: boolean } {
     const [loaded, setLoaded] = useState<{ key: string; url: string } | undefined>();
     const [failedKey, setFailedKey] = useState<string | undefined>();
-    const key = active && client && contact?.photoBlobKey ? keyOf(client, contact.uid, contact.version) : undefined;
-    const uid = contact?.uid;
-    const version = contact?.version;
+    // Bumped to load a sealed picture again: its mailbox locked (it can't be shown any more) or unlocked (one that failed can be now).
+    const [attempt, setAttempt] = useState(0);
+    // A sealed photo is always fetched (and opened) here: a URL would show the browser ciphertext.
+    const fetched = !!client || !!contact?.photoSealed;
+    const key = active && fetched && contact?.photoBlobKey ? keyOf(client ?? GLOBAL_CLIENT, contact.uid, contact.version) : undefined;
+    const sealedMailboxUid = contact?.photoSealed ? (contact.mailboxUid ?? "") : undefined;
+    const failedRef = useRef(failedKey);
+    failedRef.current = failedKey;
+
+    useEffect(() => {
+        if (!key || sealedMailboxUid === undefined) {
+            return;
+        }
+        return subscribeKeySession(({ mailboxUid, state }) => {
+            if (mailboxUid !== sealedMailboxUid) {
+                return;
+            }
+            if (state === "locked") {
+                // What the <img> decoded stays on screen until its src goes: drop it, then try again (it fails while locked: initials).
+                setLoaded(undefined);
+                setFailedKey(undefined);
+                setAttempt((n) => n + 1);
+            } else if (failedRef.current === key) {
+                setFailedKey(undefined);
+                setAttempt((n) => n + 1);
+            }
+        });
+    }, [key, sealedMailboxUid]);
 
     useEffect(() => {
-        if (!key || !client) {
+        if (!key) {
             return;
         }
         let cancelled = false;
         let held = false;
-        acquire(key, () => fetchContactPhoto(uid!, version!, client)).then(
+        acquire(key, () => loadPhoto(contact!, client), sealedMailboxUid).then(
             (url) => {
                 if (cancelled) {
                     release(key);
@@ -168,9 +258,9 @@ export function useContactPhoto(
                 release(key);
             }
         };
-    }, [key]);
+    }, [key, attempt]);
 
-    if (client) {
+    if (fetched) {
         return { src: key !== undefined && loaded?.key === key ? loaded.url : undefined, failed: key !== undefined && failedKey === key };
     }
     return { src: contact && contactPhotoUrl(contact), failed: false };

package/lib/crypto/composeSecurity.ts

@@ -47,9 +47,15 @@ function policyStateForTier(policy: EncryptionPolicy, tier: RecipientTier): Poli
 export interface RecipientEncryptionStatus {
     address: string;
     tier: RecipientTier;
-    /** The recipient's currently-active encryption certificate, if they have published (and this device
+    /** The recipient's currently-active S/MIME encryption certificate, if they have published (and this device
      * has discovered) one. */
     encryptCert?: PublicKey;
+    /** The recipient's active OpenPGP certificate - only when they have no S/MIME certificate and the server allows OpenPGP
+     * (restapi `specs/end-to-end_encryption.md` *OpenPGP Interoperability*: S/MIME is preferred whenever it can be used). */
+    openPgpKey?: PublicKey;
+    /** Which format this recipient is encrypted in: `"smime"` whenever they have an S/MIME certificate, `"openpgp"` only for
+     * a recipient whose only key is an OpenPGP one. Absent when they can't be encrypted to. */
+    format?: "smime" | "openpgp";
     /** Whether this recipient *can* be encrypted to at all right now - false when there's no usable key,
      * or the tier's policy is `prohibited`. */
     canEncrypt: boolean;
@@ -64,15 +70,24 @@ export interface RecipientEncryptionStatus {
 
 /** Per-recipient encryption eligibility, given this device's own encryption preference and the
  * system-wide policy. One entry per (address, lookup result) pair the caller already resolved via
- * `lookupKeys()` - this function does no discovery itself. */
+ * `lookupKeys()` - this function does no discovery itself. `ownCanUseOpenPgp` false: the sender has no OpenPGP key to use here
+ * (an OpenPGP copy is encrypted to the sender too), so a recipient who prefers OpenPGP but has an S/MIME certificate gets S/MIME - a
+ * preference never leaves them unencrypted (restapi `specs/end-to-end_encryption.md` *Choosing the format*). */
 export function resolveRecipientEncryption(
     ownAddress: string,
     ownPrefersMutual: boolean,
     policy: EncryptionPolicy,
     recipientAddress: string,
     lookup: KeyLookupResult | undefined,
+    ownCanUseOpenPgp: boolean = true,
 ): RecipientEncryptionStatus {
-    const encryptCert = lookup ? findActivePublicKey(lookup.keys, "encrypt") : undefined;
+    const smimeCert = lookup ? findActivePublicKey(lookup.keys, "encrypt") : undefined;
+    const usableOpenPgpKey = lookup && policy.allowOpenPgp === true ? findActivePublicKey(lookup.keys, "encrypt", "openpgp") : undefined;
+    // S/MIME, unless the recipient has no certificate or prefers OpenPGP (restapi *Choosing the format*: the user's choice for the
+    // contact, what the address advertises, what it was last seen using) - and OpenPGP only where the server allows it.
+    const useOpenPgp = !!usableOpenPgpKey && (!smimeCert || (lookup?.preferredFormat === "openpgp" && ownCanUseOpenPgp));
+    const encryptCert = useOpenPgp ? undefined : smimeCert;
+    const openPgpKey = useOpenPgp ? usableOpenPgpKey : undefined;
     const tier = classifyRecipientTier(ownAddress, recipientAddress, !!lookup && lookup.keys.length > 0);
     const policyState = policyStateForTier(policy, tier);
 
@@ -87,7 +102,7 @@ export function resolveRecipientEncryption(
         };
     }
 
-    if (!encryptCert) {
+    if (!encryptCert && !openPgpKey) {
         return { address: recipientAddress, tier, canEncrypt: false, autoEncrypt: false };
     }
 
@@ -96,7 +111,7 @@ export function resolveRecipientEncryption(
     return {
         address: recipientAddress,
         tier,
-        encryptCert,
+        ...(encryptCert ? { encryptCert, format: "smime" as const } : { openPgpKey, format: "openpgp" as const }),
         canEncrypt: true,
         autoEncrypt: policyState === "automatic" && mutual,
     };

package/lib/crypto/keyExport.ts

@@ -15,7 +15,7 @@ import * as asn1js from "asn1js";
 import * as pkijs from "pkijs";
 import type { ApiClient } from "../util/api.js";
 import { fromBase64 } from "./encoding.js";
-import { type KeyVault, type PublicKey, findActivePublicKey, recordKeyExport, type WrappedPrivateKey } from "./keyvaultApi.js";
+import { type KeyVault, type PublicKey, findActivePublicKey, isOpenPgpKey, recordKeyExport, type WrappedPrivateKey } from "./keyvaultApi.js";
 import {
     ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE,
     MAX_RETAINED_ENCRYPTION_KEYS,
@@ -147,7 +147,7 @@ async function openExportedKeys(input: KeyExportInput, vault: KeyVault, masterKe
     const active = findActivePublicKey(input.mailboxKeys, "encrypt");
     const encryption = [
         ...(active ? [active] : []),
-        ...input.mailboxKeys.filter((k) => k.useType === "encrypt" && k !== active).sort((a, b) => b.notBefore - a.notBefore),
+        ...input.mailboxKeys.filter((k) => k.useType === "encrypt" && !isOpenPgpKey(k) && k !== active).sort((a, b) => b.notBefore - a.notBefore),
     ];
     await take("encrypt", encryption, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE, MAX_RETAINED_ENCRYPTION_KEYS + 1);
 

package/lib/crypto/keyPairMatch.ts

@@ -0,0 +1,69 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Whether a certificate the server lists is really the one of a private key this device opened. A zero-access key's private half comes
+ * from an authenticated seal (or a member's wrap), but its certificate comes from the server as it is: what this device then encrypts
+ * to that certificate - the search index segments it builds from end-to-end mail, a protected meeting's key - must not go to a key the
+ * server swapped in. Plain WebCrypto and a few lines of DER, so the unlock path loads no certificate library.
+ */
+
+/** One DER element of `der` at `offset`: where its header starts, where its content starts, where it ends. */
+function element(der: Uint8Array, offset: number): { tag: number; header: number; content: number; end: number } {
+    const tag = der[offset];
+    let length = der[offset + 1];
+    let content = offset + 2;
+    if (length & 0x80) {
+        const bytes = length & 0x7f;
+        if (bytes === 0 || bytes > 4) {
+            throw new Error("Unsupported DER length.");
+        }
+        length = 0;
+        for (let i = 0; i < bytes; i++) {
+            length = length * 256 + der[content + i];
+        }
+        content += bytes;
+    }
+    const end = content + length;
+    if (tag === undefined || end > der.length) {
+        throw new Error("Truncated DER.");
+    }
+    return { tag, header: offset, content, end };
+}
+
+/** The children of the constructed element `parent`. */
+function children(der: Uint8Array, parent: { content: number; end: number }): ReturnType<typeof element>[] {
+    const found: ReturnType<typeof element>[] = [];
+    for (let offset = parent.content; offset < parent.end; offset = found[found.length - 1].end) {
+        found.push(element(der, offset));
+    }
+    return found;
+}
+
+/** The SubjectPublicKeyInfo of X.509 certificate `certDer` (RFC 5280: the seventh field of `tbsCertificate`, the sixth when it has no
+ * explicit version). */
+function subjectPublicKeyInfo(certDer: Uint8Array): Uint8Array {
+    const [tbs] = children(certDer, element(certDer, 0));
+    const fields = children(certDer, tbs);
+    const spki = fields[fields[0].tag === 0xa0 ? 6 : 5];
+    if (!spki || spki.tag !== 0x30) {
+        throw new Error("No subject public key.");
+    }
+    return certDer.subarray(spki.header, spki.end);
+}
+
+const P256_ECDH: EcKeyImportParams = { name: "ECDH", namedCurve: "P-256" };
+
+/** Whether `certDer` (a P-256 certificate) carries the public half of `pkcs8` (a P-256 private key). Never rejects: anything that won't
+ * parse or import is `false`. */
+export async function certificateHoldsKey(certDer: Uint8Array, pkcs8: Uint8Array): Promise<boolean> {
+    try {
+        const publicKey = await crypto.subtle.importKey("spki", subjectPublicKeyInfo(certDer) as BufferSource, P256_ECDH, true, []);
+        const privateKey = await crypto.subtle.importKey("pkcs8", pkcs8 as BufferSource, P256_ECDH, true, ["deriveBits"]);
+        const [certified, held] = await Promise.all([crypto.subtle.exportKey("jwk", publicKey), crypto.subtle.exportKey("jwk", privateKey)]);
+        return !!certified.x && certified.x === held.x && certified.y === held.y;
+    } catch {
+        return false;
+    }
+}

package/lib/crypto/keySession.ts

@@ -21,13 +21,15 @@
  * follow-up, not a silent gap: a mailbox enrolled *only* with a passkey has no way to unlock through this
  * module today.
  */
-import { type KeyVault, type PublicKey, type WrappedPrivateKey, findActivePublicKey, getKeyVault } from "./keyvaultApi.js";
+import { type KeyVault, type PublicKey, type WrappedPrivateKey, findActivePublicKey, getKeyVault, isOpenPgpKey } from "./keyvaultApi.js";
 import type { ApiClient } from "../util/api.js";
 import { fromBase64 } from "./encoding.js";
+import { certificateHoldsKey } from "./keyPairMatch.js";
 import { importPrivateKeyPkcs8 } from "./keys.js";
 import { KeysLockedError, buildAad, openWithKey } from "./masterKey.js";
 import { deriveFromPassword, parseArgon2idKdfLabel } from "./passwordUnlock.js";
 import { RECOVERY_KDF_LABEL, deriveFromRecoveryCode } from "./recoveryCode.js";
+import type { OpenPgpPrivateKey } from "./openpgp.js";
 
 /** AAD purpose labels — MUST exactly match what `KeyEnrollmentGate.tsx` used when it originally
  * sealed each of these values, or `openWithKey()` fails (GCM authenticates the AAD, not just the
@@ -36,6 +38,7 @@ export const MASTER_KEY_AAD_PURPOSE = "master-key";
 export const SIGNING_PRIVATE_KEY_AAD_PURPOSE = "sign-private-key";
 export const ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE = "encrypt-private-key";
 export const ZERO_ACCESS_PRIVATE_KEY_AAD_PURPOSE = "zero-access-private-key";
+export const OPENPGP_PRIVATE_KEY_AAD_PURPOSE = "openpgp-private-key";
 
 export { KeysLockedError };
 
@@ -79,6 +82,10 @@ export interface UnlockedKeys {
      * index entries and sealed summaries to - the active one first, then retained ones newest first, at most
      * `MAX_RETAINED_ENCRYPTION_KEYS + 1`. Decryption only. Absent when the mailbox has none (or none opened). */
     zeroAccessKeys?: RetainedEncryptionKey[];
+    /** The mailbox's OpenPGP secret keys (restapi `specs/end-to-end_encryption.md` *OpenPGP Interoperability*) - the active one
+     * first, then retained ones newest first, at most `MAX_RETAINED_ENCRYPTION_KEYS + 1`: what opens mail OpenPGP users encrypt to
+     * the mailbox, and signs what it sends them. Absent when the mailbox has none (or none opened). */
+    openPgpKeys?: { fingerprint: string; privateKey: OpenPgpPrivateKey }[];
     /** A shared mailbox opened through this user's member key wraps (`sharedMailboxKeys.ts`), not with its own master key: it holds
      * only `zeroAccessKeys`, and `masterKey` is a per-key secret derived from its zero-access private key (what the local search
      * index's key is derived from), never a key that opens the mailbox's vault. */
@@ -172,6 +179,17 @@ export function addZeroAccessKey(mailboxUid: string, unlocked: UnlockedKeys, key
     unlocked.zeroAccessKeys = [key, ...(unlocked.zeroAccessKeys ?? []).filter((k) => k.fingerprint !== key.fingerprint)];
 }
 
+/**
+ * Makes an OpenPGP key this device has just enrolled (`openPgpKey.ts`'s `ensureOpenPgpKey()`) the active one of `unlocked`, so
+ * OpenPGP mail to it reads without another unlock - the same rules as `addZeroAccessKey()`.
+ */
+export function addOpenPgpKey(mailboxUid: string, unlocked: UnlockedKeys, key: { fingerprint: string; privateKey: OpenPgpPrivateKey }): void {
+    if (unlocked.destroyed || sessions.get(mailboxUid) !== unlocked) {
+        return;
+    }
+    unlocked.openPgpKeys = [key, ...(unlocked.openPgpKeys ?? []).filter((k) => k.fingerprint !== key.fingerprint)];
+}
+
 /**
  * Stores the keys of a shared mailbox opened through member key wraps (`sharedMailboxKeys.ts`'s `unlockSharedMailbox()`) as that mailbox's
  * session, exactly as an unlock would - tracked for `destroyUnlockedKeys()`, and notified - unless the mailbox was locked since `generation`
@@ -272,6 +290,15 @@ function destroyObject(unlocked: UnlockedKeys): void {
         unlocked.zeroAccessKeys.length = 0;
         delete unlocked.zeroAccessKeys;
     }
+    if (unlocked.openPgpKeys) {
+        // OpenPGP.js keeps a decrypted secret key's material in its own objects: wipe it there too.
+        for (const { privateKey } of unlocked.openPgpKeys) {
+            // Present at runtime on every `PrivateKey`, missing from OpenPGP.js's type declarations.
+            (privateKey as unknown as { clearPrivateParams(): void }).clearPrivateParams();
+        }
+        unlocked.openPgpKeys.length = 0;
+        delete unlocked.openPgpKeys;
+    }
 }
 
 /** Finds the wrapped private key whose fingerprint matches a given published public key. */
@@ -309,7 +336,9 @@ export class UnopenableEncryptionKeyError extends Error {
 }
 
 /** Opens one wrapped PKCS#8 private key under `masterKey` and imports it (non-extractable by default, like
- * `importPrivateKeyPkcs8()` itself), zeroing the transient plaintext whether or not the import succeeds. */
+ * `importPrivateKeyPkcs8()` itself), zeroing the transient plaintext whether or not the import succeeds. With `certDer` - the server's
+ * certificate for it, unauthenticated - it rejects a key that certificate isn't the one of (`certificateHoldsKey()`), so a swapped
+ * certificate never pairs with the opened key. */
 async function openPrivateKey(
     masterKey: Uint8Array,
     wrapped: WrappedPrivateKey,
@@ -317,9 +346,13 @@ async function openPrivateKey(
     algorithm: EcKeyImportParams,
     usages: KeyUsage[],
     extractable = false,
+    certDer?: Uint8Array,
 ): Promise<CryptoKey> {
     const raw = await openWithKey(masterKey, wrapped, aad);
     try {
+        if (certDer && !(await certificateHoldsKey(certDer, raw))) {
+            throw new Error("The certificate isn't the key's.");
+        }
         return await importPrivateKeyPkcs8(raw, algorithm, usages, extractable);
     } finally {
         raw.fill(0);
@@ -330,7 +363,7 @@ async function openPrivateKey(
  * Opens the retained encryption keys onto `unlocked.retainedEncryptionKeys`: every published `encrypt` key in
  * `mailboxKeys` other than the active one (`activeFingerprint`), whatever its revocation or expiry, that has a wrapped
  * private key in the vault - de-duplicated by fingerprint, newest `notBefore` first, at most
- * `MAX_RETAINED_ENCRYPTION_KEYS`. A key that won't open or import, or whose certificate won't decode, is skipped and
+ * `MAX_RETAINED_ENCRYPTION_KEYS`. A key that won't open or import, or whose certificate won't decode or isn't the key's, is skipped and
  * added to `unopenableKeys`. Retained keys are imported non-extractable. Each key is attached as it opens, so a failed
  * unlock's `destroyObject()` drops those too.
  */
@@ -345,7 +378,8 @@ async function openRetainedEncryptionKeys(
     const seen = new Set<string>(activeFingerprint !== undefined ? [activeFingerprint] : []);
     const candidates: { publicKey: PublicKey; wrapped: WrappedPrivateKey }[] = [];
     for (const publicKey of [...mailboxKeys].sort((a, b) => b.notBefore - a.notBefore)) {
-        const wrapped = publicKey.useType === "encrypt" && !seen.has(publicKey.fingerprint) ? findWrappedPrivateKey(vault, publicKey.fingerprint) : undefined;
+        const wrapped =
+            publicKey.useType === "encrypt" && !isOpenPgpKey(publicKey) && !seen.has(publicKey.fingerprint) ? findWrappedPrivateKey(vault, publicKey.fingerprint) : undefined;
         if (!wrapped) {
             continue;
         }
@@ -360,7 +394,7 @@ async function openRetainedEncryptionKeys(
     for (const { publicKey, wrapped } of candidates) {
         try {
             const certDer = fromBase64(publicKey.publicKey);
-            const privateKey = await openPrivateKey(unlocked.masterKey, wrapped, aad, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false);
+            const privateKey = await openPrivateKey(unlocked.masterKey, wrapped, aad, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false, certDer);
             (unlocked.retainedEncryptionKeys ??= []).push({ fingerprint: publicKey.fingerprint, certDer, privateKey });
         } catch {
             unopenableKeys.push(publicKey.fingerprint);
@@ -372,7 +406,9 @@ async function openRetainedEncryptionKeys(
  * Opens the mailbox's zero-access private keys into `unlocked.zeroAccessKeys`: the vault's `zeroAccessKeys` that have a
  * wrapped private key, the unrevoked one with the latest `notBefore` first, then the rest newest first, at most
  * `MAX_RETAINED_ENCRYPTION_KEYS + 1`. A key that won't open is listed in `unopenableKeys` and skipped - zero-access mail
- * encrypted to it doesn't decrypt on this device, but nothing else about the unlock depends on it.
+ * encrypted to it doesn't decrypt on this device, but nothing else about the unlock depends on it. So is one whose certificate (the
+ * server's, unauthenticated) isn't the private key's: this device seals to the active key's certificate - search index segments of
+ * end-to-end mail, protected meetings' keys - so a certificate swapped by the server must never become it.
  */
 async function openZeroAccessKeys(mailboxUid: string, vault: KeyVault, unlocked: UnlockedKeys, unopenableKeys: string[]): Promise<void> {
     const ordered = [...(vault.zeroAccessKeys ?? [])].sort(
@@ -386,8 +422,17 @@ async function openZeroAccessKeys(mailboxUid: string, vault: KeyVault, unlocked:
             continue;
         }
         try {
-            const privateKey = await openPrivateKey(unlocked.masterKey, wrapped, aad, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false);
-            (unlocked.zeroAccessKeys ??= []).push({ fingerprint: publicKey.fingerprint, certDer: fromBase64(publicKey.publicKey), privateKey });
+            const certDer = fromBase64(publicKey.publicKey);
+            const raw = await openWithKey(unlocked.masterKey, wrapped, aad);
+            try {
+                if (!(await certificateHoldsKey(certDer, raw))) {
+                    throw new Error("The zero-access certificate isn't the key's.");
+                }
+                const privateKey = await importPrivateKeyPkcs8(raw, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"], false);
+                (unlocked.zeroAccessKeys ??= []).push({ fingerprint: publicKey.fingerprint, certDer, privateKey });
+            } finally {
+                raw.fill(0);
+            }
         } catch {
             unopenableKeys.push(publicKey.fingerprint);
         }
@@ -397,6 +442,38 @@ async function openZeroAccessKeys(mailboxUid: string, vault: KeyVault, unlocked:
     }
 }
 
+/**
+ * Opens the mailbox's OpenPGP secret keys into `unlocked.openPgpKeys`: its published OpenPGP certificates (`type: "openpgp"`) that
+ * have a wrapped secret key, the active one first (unrevoked, unexpired, latest `notBefore`), then the rest newest first, at most
+ * `MAX_RETAINED_ENCRYPTION_KEYS + 1`. OpenPGP.js is loaded only for a mailbox that has one. A key that won't open is listed in
+ * `unopenableKeys` and skipped.
+ */
+async function openOpenPgpKeys(mailboxUid: string, mailboxKeys: PublicKey[], vault: KeyVault, unlocked: UnlockedKeys, unopenableKeys: string[]): Promise<void> {
+    const now = Date.now();
+    const active = (key: PublicKey): boolean => !key.revokedAt && key.notAfter > now;
+    const ordered = mailboxKeys
+        .filter((key) => isOpenPgpKey(key) && findWrappedPrivateKey(vault, key.fingerprint))
+        .sort((a, b) => Number(active(b)) - Number(active(a)) || b.notBefore - a.notBefore)
+        .slice(0, MAX_RETAINED_ENCRYPTION_KEYS + 1);
+    if (ordered.length === 0) {
+        return;
+    }
+    const { readSecretKey } = await import("./openpgp.js");
+    const aad = buildAad(mailboxUid, OPENPGP_PRIVATE_KEY_AAD_PURPOSE);
+    for (const publicKey of ordered) {
+        try {
+            const raw = await openWithKey(unlocked.masterKey, findWrappedPrivateKey(vault, publicKey.fingerprint)!, aad);
+            try {
+                (unlocked.openPgpKeys ??= []).push({ fingerprint: publicKey.fingerprint, privateKey: await readSecretKey(raw) });
+            } finally {
+                raw.fill(0);
+            }
+        } catch {
+            unopenableKeys.push(publicKey.fingerprint);
+        }
+    }
+}
+
 /**
  * Unlocks a mailbox's key vault with its password unlock method: fetches the vault, derives the
  * wrapping key from `password` using the *exact* KDF parameters that wrap was created with, unwraps
@@ -409,8 +486,8 @@ async function openZeroAccessKeys(mailboxUid: string, vault: KeyVault, unlocked:
  * "incorrect password," not a generic error, but this module doesn't presume a specific UI's error copy.
  * Once the master key has opened, the password is known to be right: an active signing key that then
  * won't open is skipped and listed in `UnlockResult.unopenableKeys` (so is a retained encryption key); an active
- * encryption key that won't
- * open still fails the unlock, with `UnopenableEncryptionKeyError`. Throws `KeysLockedError` when
+ * encryption key that won't open, or whose certificate isn't its own,
+ * still fails the unlock, with `UnopenableEncryptionKeyError`. Throws `KeysLockedError` when
  * `destroyUnlockedKeys()` locked this mailbox (or all mailboxes) while the unlock was in flight.
  */
 export async function unlockWithPassword(mailboxUid: string, mailboxKeys: PublicKey[], password: string): Promise<UnlockResult> {
@@ -555,18 +632,31 @@ async function openSession(
         const encryptionPublicKey = findActivePublicKey(mailboxKeys, "encrypt");
         const wrappedEncryptionKey = encryptionPublicKey && findWrappedPrivateKey(vault, encryptionPublicKey.fingerprint);
         if (encryptionPublicKey && wrappedEncryptionKey) {
+            let encryptionCertDer: Uint8Array;
             try {
+                // The certificate is the server's: one that isn't this key's - what this device encrypts its own copies to, and what it
+                // hands out as its S/MIME certificate - makes the key unopenable, exactly as a wrap that won't open.
+                encryptionCertDer = fromBase64(encryptionPublicKey.publicKey);
                 const aad = buildAad(mailboxUid, ENCRYPTION_PRIVATE_KEY_AAD_PURPOSE);
-                unlocked.encryptionPrivateKey = await openPrivateKey(masterKey, wrappedEncryptionKey, aad, { name: "ECDH", namedCurve: "P-256" }, ["deriveBits"]);
+                unlocked.encryptionPrivateKey = await openPrivateKey(
+                    masterKey,
+                    wrappedEncryptionKey,
+                    aad,
+                    { name: "ECDH", namedCurve: "P-256" },
+                    ["deriveBits"],
+                    false,
+                    encryptionCertDer,
+                );
             } catch (err) {
                 throw new UnopenableEncryptionKeyError(encryptionPublicKey.fingerprint, err);
             }
-            unlocked.encryptionCertDer = fromBase64(encryptionPublicKey.publicKey);
+            unlocked.encryptionCertDer = encryptionCertDer;
             unlocked.encryptionFingerprint = encryptionPublicKey.fingerprint;
         }
 
         await openRetainedEncryptionKeys(mailboxUid, mailboxKeys, vault, unlocked, encryptionPublicKey?.fingerprint, unopenableKeys);
         await openZeroAccessKeys(mailboxUid, vault, unlocked, unopenableKeys);
+        await openOpenPgpKeys(mailboxUid, mailboxKeys, vault, unlocked, unopenableKeys);
         if (lockGeneration(mailboxUid) !== generation) {
             // Locked (e.g. logout) while this unlock was awaiting - never restore keys after that.
             throw new KeysLockedError();