logoalt Hacker News

LamGCtoday at 3:42 AM0 repliesview on HN

My GPG key is renewed expire date every 2 years, and the main key and sub key are separated (the main key is stored offline, and the sub key is on YubiKey). The private key does not need to be updated regularly, so it can be directly encrypted and saved in the backup.

I think this is a good balance point, and I estimate that if we want to rotate the keys completely in the future, we should start using new key algorithms. (I estimate it will take another 5-8 years)