How am I supposed to use a revocation certificate, and can there be multiple revocation certificates for the same private key?

Question

I just generated a revocation certificate for my key. Unfortunately I don't fully understand the concept. Here are my questions:

1. How exactly am I supposed to use it?

   Suppose for example that my private key gets compromised.

   What exactly I am gonna do with my revocation certificate?

   For instance, send an e-mail to all my acquaintances saying "Look, private key compromised, here is the revocation certificate?" (Why not just "Look, private key compromised."?)

   Should I publish the revocation certificate on my website, in case the private key gets compromised?

2. If I re-run the same command in GnuPG, will I get a different revocation certificate? Or does it strictly depend on the private key only, so that given the private key one and only one revocation certificate is possible?

Answer 1

You use the revocation certificate, which gets generated by GPG earlier, to prove your intention to revoke the certificate

What exactly I am gonna do with my revocation certificate?

For instance, send an e-mail to all my acquaintances saying "Look, private key compromised, here is the revocation certificate?" (Why not just "Look, private key compromised."?)

Scenario: you lost your key. If an attacker tells acquaintancies "Look, I lost the key" unsigned, how can the recipient attest the authenticity? You and the attacker can't sign messages. Certificate revocation prevents DoS in this case

Scenario: the key is compromised. Both you and the attacker can sign messages and send revocation certificates. Because of this, it makes no sense to send an email "Look, my key was compromised. Here is the new certificate" because both you and the attacker can both sign messages and revocations. As soon as you warn your acquaintances, you must renegotiate a certificate out of band.

If I re-run the same command in GnuPG, will I get a different revocation certificate?

I don't have this information but I can guess-answer. The two revocation certificates may or may not be binary equal (try it yourself) as soon as they store some variable information like timestamp.

But in general the revocation certificate must be bound to the public key, which is the only information the acquaintances can know, so in general it should be the same no matter.