How to single key decrypt pgp encrypted mails in a multi key/multi identitiy setup?

Question

For pgp encryption I'd like to combine short expiry terms for public signing and email encryption with (convenient) long term decryption possibilities of my mailbox mails.

I'm using several mail addresses where each is used and issued only for a different group of people. For each mail address thus I have a different key-pair to expose only one address to a certain group. In this setup encrypted mails in my inbox force me to keep all the expired keys and passwords which I find very inconvenient.

My idea was to have

• a single non-publicly issued, non-expiring key-pair for mailbox purposes (re-encryption?, decryption)
• several publicly issued, short expiry, independent key-pairs for several mail addresses

Which ways do exist to achieve my desired setup? Do for example master and sub-keys provide a possibility to decrypt my mailbox with a single, non-public key-pair for multiple identity independent sub-keys? If no, how do I automatically decrypt end re-encrypt mails over imap by script or mail client?

Answer 1

I don't believe OpenPGP has a mechanism built in to handle this situation. If your goal is to have a repository of emails, all encrypted with a single non-publicly-shared identity's key I'd suggest just creating an archives identity/keypair/email and forwarding all messages to that address yourself.

Of course, if you delete an identity's private key and later receive new messages encrypted for that identity you wont be able to read them.