The Qubes OS team stores their Master Signing Key on an offline machine (running Qubes of course) and use it to sign the keys of the team members: https://www.q

The Qubes OS team stores their Master Signing Key on an offline machine (running Qubes of course) and use it to sign the keys of the team members: https://www.qubes-os.org/security/verifying-signatures/#how-to-import-and-authenticate-the-qubes-master-signing-key https://www.qubes-os.org/security/verifying-signatures/#how-... The developer signing keys are set to expire after one year, while the QMSK [Qubes Master Signing Key] and RSKs [Release Signing Keys] have no expiration date. The QMSK was generated on and is kept only on a dedicated, air-gapped “vault” machine, and the private portion will (hopefully) never leave this isolated machine. Alternatively one could use split-gpg, but it's probably a tiny bit less secure: https://www.qubes-os.org/doc/split-gpg/ https://www.qubes-os.org/doc/split-gpg/. See also: https://github.com/QubesOS/qubes-issues/issues/2818 https://github.com/QubesOS/qubes-issues/issues/2818