I read often that you should not share a PGP private key. I understand that and it makes sense. If someone has my private key (and manages to obtain the password for it), I can be impersonated.
But are there usecases where sharing a private key is considered okay? Considering two scenarios, where we have a shared directory with only lax management of access rights to it:
- Encrypting the file with a public key and sharing the (password protected) private key dedicated for this purpose
- Encrypting the file with AES-256 (e.g. using 7-zip) and sharing the password
Having only these two options, I would consider the first one to be more secure.
Is there a better way to implement this access control if only the described infrastructure is available? I know both options are not ideal and also do not allow to revoke access for a specific user.