I am trying to work out what is the best approach for managing GPG keys over my career when I change jobs.
My understanding is that there are two ways this could be done:
- Have one main/master GPG key with subkeys for signing and encryption.
- Have multiple GPG keys.
I am more confident and leaning towards having one GPG key with subkeys and multiple user IDs.
Everytime I start a new job with an organisation, I would create a new User ID with the email address for that company. I would also revoke the previous User ID.
Does this seem ok? Or am I missing something?