5

I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs.

My understanding is that there are two ways this could be done:

  1. Have one main/master GPG key with subkeys for signing and encryption.
  2. Have multiple GPG keys.

I am more confident and leaning towards having one GPG key with subkeys and multiple user IDs.

Everytime I start a new job with an organisation, I would create a new User ID with the email address for that company. I would also revoke the previous User ID.

Does this seem ok? Or am I missing something?

Improve this question

1 Answer 1

Reset to default
5

I'd first check the organization for their policies. They may not even allow GPG.

I'd use multiple GPG keys, one per organization. An organization may require you to hand over your GPG keys to get to the data encrypted with it. If you change jobs or identities within an organization then you might want to use sub-keys.

And, as usual, always keep your private and company life separate - certainly when it comes to key material.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .