Full Changelog: v4.3.0...v4.3.1
A feature-heavy release: a certificate-based PKI layer for signing/encryption keys (with revocation), deniable "sealed sender" authentication, optional time-locked encryption, and unsigned native installers for Linux and macOS.
Signable public key certificates
A minimal PKI layer over the existing signing module — a CA key certifies a subject's public key with a label, validity window, and usage bitmask (encrypt/sign), so recipients no longer need to trust a raw key file out of band.
New CLI: issue-cert, verify-cert, revoke-cert
encrypt -r, verify -k, signcrypt -r, signdecrypt -v, and seal -r all accept a certificate PEM in place of a raw key via --ca-key
Revocation: a compact CRL-style revocation list (--revocations ) lets a CA invalidate a certificate before its validity window expires
Full GUI support (desktop + web): new "Issue / Verify / Revoke Certificate" panel in the Keys tab, and certificate files can be dropped straight into the Encrypt tab's recipient picker
Sealed sender
Deniable sender authentication — proves to a specific recipient who sent a file without leaving evidence a third party could ever verify (unlike signcrypt's non-repudiable signature).
New CLI: identity-keygen, seal, unseal
Uses a static-static X25519 Diffie-Hellman between separate sender/recipient identity keypairs
New "Sealed Sender" tab in the GUI (desktop + web)
Time-locked encryption (opt-in, tlock feature)
Encrypt a file so nobody, including the sender, can decrypt it before a chosen future time.
encrypt --tlock-round , decrypt --tlock, and pqfile tlock round "24h"|"7d"| to resolve a time to a drand round
Built on the drand public randomness beacon; the only network-touching code path in pqfile, gated behind an off-by-default Cargo feature so a normal build never links an HTTP stack
CLI-only for now; GUI wiring is a follow-up
Native OS installers
release.yml now packages Linux .deb/.rpm/AppImage and a macOS .app/DMG alongside the existing Windows installer, all built from the same PGO-optimized, cargo auditable binaries.
Note: none of the new packages (or the existing Windows installer) are code-signed or notarized — Windows SmartScreen and macOS Gatekeeper will warn on first launch. Signing certificates are a separate cost/account decision.
WebAuthn passkey second factor (implemented, disabled by default)
The web GUI gained a browser-passkey (WebAuthn PRF) second factor to mirror the native FIDO2 flow — but real-world browser/OS support is currently too inconsistent to ship enabled (confirmed broken in different ways on Bitwarden, Windows Hello/Edge, and Firefox). The implementation is complete and tested; the UI selector stays disabled with a tooltip until support stabilizes.
Under the hood
Internal code-quality pass: eliminated duplicated logic across the certificate, sealed-sender, and GUI action-button code paths
Fixed a handful of CodeQL false-positive alerts on protocol length constants and the CLI's decrypt-to-stdout path
No breaking changes to the .pqf file format or key formats in this release.