This question already has an answer here:
To improve my privacy, I would like to use PGP to encrypt/sign my e-mails.
How should I proceed to use PGP in a secure fashion?
I am trying to think about how to do it properly. From what I found, There is 2 main issues:
For the key generation, it seems that using RSA/RSA with a keysize of 2048-bit is largely enough. I immediately generate a revoke certificate and store it somewhere safe (print it as a QR code).
Then I send my public key to the keyservers.
However, what seems the most obscur to me is how should I proceed when my PGP is about to expire. Should I just forgot about the old one and generate a new pair? Wouldn't that create a duplicate on the keyserver? Should I revoke my old key pair?
I couldn't find any good information about this; people seem to only focus on the key generation.
Note that I am not only interested in the key rollover, because I may miss an important issue (as I didn't know about keeping a revoke certificate before loosing my first key pair, ahem).
If I am missing an important point, do not hesitate to mention it.