Funding / Sponsoring

badkeys is currently operated as a private project by Hanno Böck without any external funding.

While keeping the web page and software available requires few resources, this limits the effort put into improvements of the software, better coverage of known-compromised keys, and regular scans of public key collections.

In the past, badkeys has been used to scan WebPKI certificates from Certificate Transparency logs, as well as public keys used in DNSSEC, DKIM, OpenID Connect, and elsewhere. In almost all cases, badkeys discovered vulnerable keys in real-world deployments. Currently, no such scans are performed on a regular basis.

If you think regular scans of public keys for known vulnerabilities would be a valuable service, you may consider supporting or sponsoring badkeys. This could either mean sponsoring a specific activity, e.g., a feature or regular scans of specific public key ecosystems or generic sponsoring of the project.

Sponsoring can also be tied to consulting (cryptography or, more broadly, IT security).

If any of this sounds interesting to you, you can find my contact details here.

Previous funding

The development of badkeys initially received funding in 2022 by Industriens Fond through the CIDI project (Cybersecure IoT in Danish Industry) and the Center for Information Security and Trust (CISAT) at the IT University of Copenhagen, Denmark.

In 2025/2026, badkeys was supported by NLnet's NGI0 Core Fund.