Curious to know what the standard practice is to maintain old/revoked certificates that were previously used to sign documents that must be verified in the future.
For example, suppose there is a service that signs documents and they have a valid SSL certificate valid for one year. The service signs documents 0-1000 during the first year, 1000-2000 the second year, etc. (to keep things simple). After ten years, there will be a new certificate used for documents 9000-10000, however customers need to verify any/all of the previous documents signed with old keys. At this point they will have 10 certificates/public keys total.
So, the private key can be taken off the server to protect it from compromise, but the public key will need to remain for verification through the service itself (and the customers can also keep a copy of the public key for their own verification). In this case, does the service either:
a. loop through all the previous public keys to see if one fits
b. re-sign all of the old signatures each time a new private key is purchased
c. keep track of which documents were signed with which particular key?
d. another option not mentioned here
Also included is the possibility that in year 5, the private key used to sign documents 4000-4500 has been revoked, so a new key was needed for 4500-5000 (after any security issues were resolved).