Should I delete lost GPG key from GitHub?

Question

I've been using GPG key for a while to sign commits on GitHub. However, I recently lost it by accident when moving data around. It haven't leaked anywhere and signed commits can be trusted, I just don't have private key anymore.

So, should I delete public key from my GitHub account? This will remove "signed" mark from commits which seems to be wrong in my case when I just can't make any new commits with it.

Answer 1

I don't see any reason, why you would need to remove it. Losing the key changes nothing about its security. The key could have leaked, or could be broken later but that applies to a key you did not loose as well. You should rotate your keys in general.

In my opinion, it would be a better idea to keep it for as long, as you trust the key, so people can see you still trust the signatures. You can likely remove it, once the commits signed by it are no longer relevant.

A commit hash includes the hash of the previous commit, which means a single commit signed with the new key verifies all commits that came before it. Hence, the old key is only relevant, if some branches don't have a new commit or if the users work with old versions of the code.

Answer 2

• If someone already had access to the key but didn't use it yet, they might still do so.
• In case someone gets their hands on an old backup, they might be able to use the key.
• There is no known vulnerability, but there might be in the future, giving an attacker access because you still have a key from 2019 added (who knows, in 2021 we might discover a debian PID-based key generation-like bug, or in 2029 an attacker might have a quantum computer, or...).
• If you find your key again, you can always re-add it.

Why not remove it? It is good data hygiene to just clean up access keys that should never access a system anyway.