3 ms·
Yeah, I'm trying to follow these practices, and lot of good ideas. In the process there were some surprising things (to me at least) implementing "Use an expira
by imrehg 11y ago
Yeah, I'm trying to follow these practices, and lot of good ideas. In the process there were some surprising things (to me at least) implementing "Use an expiration date less than two years." It's reasonable advice, while I did not predict, that in that case, the key file (e.g. the public key) size will increase every time the key is renewed. I know it's kilobytes, so should not matter. But in web interfaces where you would paste the key (such as today's Github update) I'm not sure if they have set a max-size. If using a strong key (many bits), and renewing every year (or every 2 years), I'm sure that public key will balloon... Also, now that GPG keys are used in many different settings, likely have to remember to upload the renewed key not just to the keyservers, but to keybase.io / github / etc, otherwise end up with strange breakages, I don't think expiring keys are expected in general.
- ashitlerferad 11y agoExpiring and revoking keys is a core part of how OpenPGP is meant to work. Export just the valid self-sigs: --export-options parameters export-minimal Export the smallest key possible. This removes all signatures except the most recent self-signature on each user ID. This option is the same as running the --edit-key command "minimize" before export except that the local copy of the key is not modi- fied. Defaults to no.
- imrehg 11y agoI know it is supposed to work like that, though in practice that's not how people seem to use it (ie. the issue of "you are holding it wrong"). Thanks for this parameter, did not know that before, and this should help a lot! :) I guess it should be something to be pointed out in the docs as well as relevant feature?