It's possible to set "valid-before" and "valid-after" timestamps on SSH keys in the allowed signers file: https://man.openbsd.org/ssh-keygen#ALLOWED_SIGNERS ht

It's possible to set "valid-before" and "valid-after" timestamps on SSH keys in the allowed signers file: https://man.openbsd.org/ssh-keygen#ALLOWED_SIGNERS https://man.openbsd.org/ssh-keygen#ALLOWED_SIGNERS When validating the SSH signature, Git can set the verify-time option to the commit timestamp and the signature will be rejected if the key is not valid at that time. Git doesn't yet do this, but will in a future version. This is considerably simpler than the rigamarole of GPG subkeys.