On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits.
However, in the scenario that the private key is exposed, the only option GitHub offers is to remove the associated public key. Unfortunately, this also marks all your past commits as unverified.
At this point, my initial thoughts were to securely shred the existing gpg private key and start using a new gpg key every x months so that only the very latest commits would be marked unverified. With this approach, I don't see any problems as long as GitHub does not have a limit on the keys that can be uploaded. However, I was wondering: What is considered to be the best practice pertaining to this situation?
