Use a smart card. After creating your secret key(s), you move them to the card (or you can create the key inside the card, so it is never seen by your PC). The

Use a smart card. After creating your secret key(s), you move them to the card (or you can create the key inside the card, so it is never seen by your PC). The card has no capability of exporting them so they will never be leaked. You can only wipe the card clean and start over. To further protect your PIN-code for the card, you can use a card reader with integrated keypad, which should work against most key-loggers. For GPG you most certainly can invalidate a key, in fact, this is a crucial part of the key-generation and management process. Along with the public/private key pair, you also generate a key revocation certificate. The revocation cert can then be uploaded to the key-server in the case that your key gets compromised. A well behaving GPG-client will check the validity of the public keys in your key chain, and if it encounters a revocation key against the public key you are trying to use, it will then disable it and warn you. For more, see: http://g10code.com/p-card.html http://g10code.com/p-card.html and https://www.crypto-stick.com/ https://www.crypto-stick.com/