What is the common practice when a subkey reaches its expiration date?
- Generate a new subkey
- Increases security if the subkey has been stolen (without noticing) since Malory cannot use the old one anymore for future attacks
- I cannot decrypt my documents or authenticate on my servers
- Extend the expiration date of the existing subkey
- Pros and cons: the exact opposite of the first solution
Note that my subkeys are stored on multiple external storages for backup and modification purposes and well hidden, and on a smartcard (Yubikey) to use on a daily basis. That is, even if my smartcard is physically stolen, the thief shouldn't be able to extract the private part of the subkey, making the pro of the first solution not that relevant.
Please complete the pros and cons if there are some missing.