Deny Public Key updates and add private key tranfer for desktop and mobile

[hackthedev]

[valipuha]

I think this should be split into two parts:

1. Lock public key updates server-side

• Right now the stored publicKey is used for key-based auth, so it should behave like an identity key.
• The safest rule is:
  • allow setting publicKey only when the account is first created
  • reject later publicKey changes in updateMember
  • if key rotation is ever needed, make that a separate explicit flow instead of piggybacking on generic profile/account updates

2. Add private key transfer at the launcher/mobile layer

• The current account export/import flow only handles the server-side account object.
• I couldn’t find any existing bridge method for exporting/importing the private key, only methods like GetPublicKey, SignJson, SignString, EncryptData, and DecryptData.
• So private key transfer needs new native bridge APIs on desktop/mobile first.

Suggested implementation shape:

• launcher/mobile:
  • add ExportPrivateKey / ImportPrivateKey style bridge methods
  • export the private key encrypted with a user passphrase or platform keystore protection, never raw
• web/client:
  • extend account export/import UI to include the encrypted key bundle
  • after import, verify the imported private key matches the stored public key
• server:
  • deny publicKey overwrites after first set
  • if a future key rotation flow is needed, require proof with the old key or a dedicated recovery flow

So yes, I think the issue makes sense, but the important detail is that the second half depends on native client work, not just server/web changes.

[hackthedev]

will likely make it so that the desktop client shows a qr code to export its private key that can be scanned with the mobile client. gotta do the same in reverse too but without scanning, prob file based