Add config option for keys to use to sign keys

This allows servers to separate keys that are used to sign remote keys
when acting as a notary server.

1 files changed, 7 insertions, 5 deletions

diff --git a/synapse/crypto/keyring.py b/synapse/crypto/keyring.py
index 6c3e885e72..a3b55e349e 100644
--- a/synapse/crypto/keyring.py
+++ b/synapse/crypto/keyring.py
@@ -540,11 +540,13 @@ class BaseV2KeyFetcher(object):
                     verify_key=verify_key, valid_until_ts=key_data["expired_ts"]
                 )
 
-        # re-sign the json with our own key, so that it is ready if we are asked to
-        # give it out as a notary server
-        signed_key_json = sign_json(
-            response_json, self.config.server_name, self.config.signing_key[0]
-        )
+        # re-sign the json with our own keys, so that it is ready if we are
+        # asked to give it out as a notary server
+        signed_key_json = response_json
+        for signing_key in self.config.key_server_signing_keys:
+            signed_key_json = sign_json(
+                signed_key_json, self.config.server_name, signing_key
+            )
 
         signed_key_json_bytes = encode_canonical_json(signed_key_json)