What is the best practice for choosing GPG user id(s)?
I've read various bits of advice, which sometimes even contradict each other. For instance, I've read that one should not use comments, because they are not part of your identity. But strictly speaking, neither is your email address (as it likely will change, and might even be owned by another person later). I've also read a suggestion on this site that one can avoid using an email address and use only a comment to provide some personally-identifiable information, such as DOB*.
Also, an address-less ID is of less use in a mail client situation.
So given that I want a master key to last a life time (or as close as possible), how should I choose my user ID(s)?
At this point I'm leaning toward:
- Primary ID with my full name (First, middle, and last)*
- A JPEG ID with a passport-style photo
- Additional IDs (First Name, Last Name) for each email address I intend to use
The idea is that the primary ID will never change, while email addresses and appearance (for the JPEG id) likely will change over time.
As I acquire signatures, assuming the signors sign all of my currently active IDs, the Primary address-less id will continue to accrue signatures, while the others may come and go.
*I'm intrigued by the idea of including one's place and date of birth in their primary ID, but I'm concerned about the possible breech of privacy. While it may not be difficult to find someone's DOB, it's not the kind of information I generally publicize to the world. Is there any reason that something more than just my full name ought to be included? For that matter, is my middle name or initial going to add anything?