DeviceKey implements kv-ffi's DeviceSigner.reset(): it deletes the key material
(TPM key, DPAPI file, Secret Service / keychain entry, or key file) and the
device-id and store files, then creates a new key with a new id in the best
store available. The core calls it on device_revoked and retries a setup code's
ticket once, so a fresh Add-a-device code signs a removed computer straight in.
DeviceRevoked explains how to set it up again; the fingerprint shown refreshes.
Removing a device warns that it must be set up again as a new one.
Test: end to end through kv-sync's test server (new dev-dependency).
The Windows TPM/DPAPI paths could not be compiled here (no Windows SDK for ring).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
samiandClaude Opus 5.5
86c21f3bff