Does GPG key expiration add to security?

Question

I've created a new GPG key to sign a software package in a source repository, with an expiration date three years from now. It seemed like a good security measure, because if the key is compromised or stolen - the damage will be limited.

But then I thought about the day when I will need to sign my new key. Signing the new key with the old key seems equivalent to keeping the old key, and thus adds nothing to security.

Does setting an expiration date improves key security? If so, what's the best expiration\key replacement policy?

Answer 1

Does setting an expiration date improves key security?

Yes. You've already said why, too:

It seemed like a good security measure, because if the key is compromised or stolen - the damage will be limited.

Assuming you are compromised and the key is stolen, clearly, your first action would be to revoke the key and issue a new one. However, not everyone will check for revoked keys; they'll continue blindly using it until it becomes invalid.

Likewise, if you're compromised, somebody can only pretend to be you for a fixed window.

If so, what's the best expiration\key replacement policy?

There really isn't one - the question is more "what is the best I can do given constraints X Y Z". For example, if you set the Window too small, you inconvenience users; however, too high and you open up the risk if compromised. It really comes down to a judgement call - how sensitive exactly is what you're protecting and how often/inconvenient is it to replace keys frequently?