I'm phasing out my old OpenPGP key and am creating a new one. I plan to lock away the main key and do daily work only with subkeys.
The subkeys will be valid for a year and I'll add new ones after that time.
Should I make one subkey each year that is used for both signing and encryption (RSA keys support that)? The alternative would be to have two keys, one for each task.
There is a question about that in general, but I don't think it applies to me:
- I'm specifically talking about OpenPGP/GnuPG
- Key escrow at work is no problem since I only use the key for private communication
If the answer is "potentially insecure" - does this hold for RSA OpenPGP keys? Why?