I'm looking for input on GnuPG (gpg) best practices. It's been discussed some on the gnupg-users mailing list, but I wanted to get as diverse a view as possible, so I thought to bring the topic to the experts here at SE.
I'm in the process of transitioning e-mail accounts and thought it would be a great time to also transition my GPG key. I currently have a RSA-4k key that is used for sign, certify, and encrypt all in one.
My current thoughts are to generate a new key with a certify-only primary key that would be kept offline and separate encrypt & sign subkeys for daily use. I think this would allow my Web of Trust to grow best while still protecting my data. Additionally, it would separate my encryption & signing in the (unlikely) event I am ever forced to hand over one key.
Are there pros/cons that I have not considered? Is it better to go with RSA3k in case I ever decide to use a smart card?