I think most privacy-conscious people have a pretty good idea about how to maintain proper private key hygiene (key should never leave the device, use FDE + a p

I think most privacy-conscious people have a pretty good idea about how to maintain proper private key hygiene (key should never leave the device, use FDE + a passphrase or a hardware token, etc). But we've been leaking metadata (such as mail headers) left and right ever since PGP was a hot new thing, something which should've been our primary concern no later than since Snowden/2013. It would be good to have a proper field guide written down, that's a little more in-depth than "leave your phone at home", weighing risks vs convenience, going into detail on what kinds of metadata you might be leaking, etc. Most of us have some rough idea but it isn't at all obvious the way we know "MD5 is broken".