I use full-disk encryption. Should I passphrase-encrypt my private key(s) anyway?

Question

Suppose I want to use GnuPG on a GNU/Linux laptop where I've encrypted all filesystems (except /boot) with LUKS/dm-crypt. Backups are encrypted client-side and stored on a physically secure server. Given that my files are already encrypted-at-rest, is it worth the trouble to passphrase-encrypt my private key as GnuPG suggests I do?

If so, describe the exploit(s) that would enable an attacker to steal my private key file but not my passphrase. How practical are such exploits compared to those that LUKS already defends against (e.g. seizing the laptop from my luggage) and those that would defeat both LUKS and the GnuPG passphrase (e.g. an evil maid or a remote code execution vuln, both of which could get a keylogger installed)?

Answer 1

Local file read vulns occur sometimes. They're most common on servers, especially web servers, but can occur in any software that communicates with a remote machine. That would give a user your keys, but not allow installing a keylogger.

Also, installing a keylogger is a lot less reliable of an attack than just stealing an unprotected key. With a keylogger, the attacker needs to escape notice, needs to have the logger running when you next type in the relevant password, needs to actually catch and recognize the password, needs to have some way for the logged keys to get off your machine and to the attacker... and all of that will take time (until you next enter the password) instead of being usable immediately.