1 files changed, 3 insertions, 0 deletions
diff --git a/yuck.mdwn b/yuck.mdwn
index 5a4ad2b..3c81250 100644
--- a/yuck.mdwn
+++ b/yuck.mdwn
@@ -183,6 +183,9 @@ reference in discussions.
   authentication cannot ever succeed.
 * (KILLSESSION) It must be possible to kill existing web sessions to
   kick out someone who is logged in to Yuck.
+* (KEYROTATION) The IDP MUST rotate signing keys so that a leaked key
+  can be easily replaces. The IDP MUST have a secure way to distribute
+  the key to clients.
 
 
 # Architecture: the ecosystem