> There is at least one major flaw, which is that GPG keys can and often do expire, ... So once you replace the master GPG key for your domain, your old comment

> There is at least one major flaw, which is that GPG keys can and often do expire, ... So once you replace the master GPG key for your domain, your old comments will flag as invalid/unverified. e.g. GitHub shows whether commits have been signed by GPG. An expired key doesn't necessarily need its secret replaced. The key can just have its expiry date extended.