Root-level age keys

[musjj]

In addition to the user's home directory, sops should look for age keys on the root-level: /etc/sops/age/keys.txt.

This is useful if you want your age keys to be owned by root instead of the user.

[felixfontein]

Having secret encryption keys lying around world-readable on a machine sounds like an antipattern to me. I guess there are some special valid use-cases, but I don't think this is something we should support in general.

You can always set SOPS_AGE_KEY_FILE to point to that file (or any other global file) for all users (like in /etc/profile), then you basically have that behavior (unless a user explicitly sets that to something else).

[musjj]

The best practice would be to not make them be world-readable, just like other secrets such as /etc/ssh/ssh_host_ed25519_key. In this case they will only be readable in say, privileged services.

Though the decision is up to the users creating the secrets, of course (maybe a warning can be printed when the secret is world-readable?).