The best document I've found for key generation (the one I turn to myself, when my memory needs refreshing) is the one on Riseup: https://help.riseup.net/en/sec

The best document I've found for key generation (the one I turn to myself, when my memory needs refreshing) is the one on Riseup: https://help.riseup.net/en/security/message-security/openpgp/best-practices https://help.riseup.net/en/security/message-security/openpgp... . If you follow that guide, you will get a keypair that avoids the common pitfalls. The photo question is an interesting one - some people frown on it, some people like it. Personally, I lean towards not adding them, just because the number of times I've actually checked it is so low (maybe once, ever.) That being said, I don't think people feel so strongly that they'd refuse to use or sign your key over it; they might just not sign that particular uid. (The photo is stored the same way an alternate email is, basically.) Properly setting up an offline subkey involves some rather archaic incantations; even more so when you are burning them into a smart card. Specifically, I would probably use some combination of the above instructions (to get my gpg.conf into the correct state), and then something like this guide: https://gist.github.com/abeluck/3383449 https://gist.github.com/abeluck/3383449 Specifically, I would look for a guide that instructs you to have a master key that is valid only for certification. I have a personal dislike for allowing your "master" key to be used for encryption, because it incentivizes you to do things that are not best-practice: specifically, using it. In the ideal world, your master key is kept, encrypted, on one (or more) USB drives that are all kept in various safes, and are never plugged into a computer that has an internet connection. Bonus points if the computer isn't used for anything else either. This is because your master key is the Thing That Must Not Be Compromised -- or you need to revoke the entire key and can never use it again. If a "working" subkey gets compromised, you can revoke it without losing all of the certification effort you've put into validating your identity in the web of trust.