I've created a Keybase account and imported the "easy" identities (e.g. Twitter, Reddit). Now it's time to get my PGP key there.
I had expected instructions to PGP-sign a specific text from the Keybase (Windows) app and re-upload that signed data (base64 or some such). Instead, what I find is this:
# import a key from gpg's key chain
keybase pgp select
#import from stdin and send the public half to Keybase
cat privkey.asc | keybase pgp import
# for more options
keybase pgp help
At first, I thought that they were 3 instructions to be followed in order, but then I realized they were 3 different main things you could do.
Can someone explain in basic terms (I know the basics of PGP and public/private key pairs) what the first two options entail behind the scenes?
Specific questions I'd have:
- Does either option 1 or 2 give permanent access for the Keybase app to my PGP private key? Or is it just one time to sign a proof that the public key is mine?
- Does option 2 mean you need to have your private key in a file at your current location? Is the file typically protected with your passphrase?
- Any other specific risks or things I should be aware of? I want to make very sure my PGP private key remains my own.
I can speculate to the answers myself, but since it's important stuff I'd rather ask, to be sure.