To improve my privacy, I would like to use PGP to encrypt/sign my e-mails.

How should I proceed to use PGP in a secure fashion?

I am trying to think about how to do it properly. From what I found, There is 2 main issues:

  1. Key generation

  2. Key rollover

For the key generation, it seems that using RSA/RSA with a keysize of 2048-bit is largely enough. I immediately generate a revoke certificate and store it somewhere safe (print it as a QR code).

Then I send my public key to the keyservers.

However, what seems the most obscur to me is how should I proceed when my PGP is about to expire. Should I just forgot about the old one and generate a new pair? Wouldn't that create a duplicate on the keyserver? Should I revoke my old key pair?

I couldn't find any good information about this; people seem to only focus on the key generation.

Note that I am not only interested in the key rollover, because I may miss an important issue (as I didn't know about keeping a revoke certificate before loosing my first key pair, ahem).

If I am missing an important point, do not hesitate to mention it.


A key that has expired does not need to be revoked. Generate a new key and sign it with the old one.

It shouldn't be a problem that there is more than one key under your name on the key servers. Remember, never trust a key based on the name/e-mail address in its uid! Anyone could put that there. Always check the fingerprint and/or trusted signatures on the key.

  • Could you give more information about signing the old key with the new one & trusted signatures, please? – TomTom Mar 24 '16 at 13:07
  • You may want to read the answer again. – Tobi Nary Mar 24 '16 at 13:57
  • Other way around - sign your new key with the old one. So the first signature on your new key is made by the old key. – Mark Koek Mar 29 '16 at 9:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.