I've found it a good practice to add a YYYYMMDD serial number: -z 20200402 That way, keys generated within a certain time interval can be revoked with a s

I've found it a good practice to add a YYYYMMDD serial number: -z 20200402 That way, keys generated within a certain time interval can be revoked with a simple serial number check.