Why should I separately backup my revoke certificate

Question

So I understand the principles behind the concept of a revocation certificate and why it should be useful to create one and back up before harm occurs. The thing is, I don't see a wide range of media (or any at all) on which it makes sense to do this in practical life.

Here's what I'm taking into consideration:

Having your revoke certificate compromised is an annoyance.
Losing your revoke certificate is potentially a major problem.
Having your private master key compromised is potentially a major problem.
Losing your private master key is an annoyance.
You can reproduce a revoke certificate if you're in possession of the master secret key
If you have your master private key entirely offline: you'll actually gonna need it more often than your revoke certificate.

With that in mind, every time I picked a media or a way to store my revocation certificate, I thought "hell, I might as well backup my entire private key set on this [because I deem this media safe enough]". At the end of the day, I backed up only private keysets.

To me a media that would indeed fit the bill for storing your revoke cert only would be very (very) reliable, at the expense of (some) security, and ease of access.

Do you see any such media, or are any of my assumptions wrong? Why and where do you store your revoke certif on its own? I'm thinking maybe some kind of on the cloud storage which I wouldn't dare with my master keyset, but I don't know if I'd find it safe enough even for a simple revoke certif, without getting too complex (given I can't of course encrypt it with my GPG key).

Answer 1

You can backup your revocation certificate to a more reliable, but less secure place (friends, relatives); losing it is just an annoyance. You probably wouldn't do that with your private keys, losing them is a catastrophe (or major problem, as you described it).

Just storing to multiple devices does not seem reasonable. Maybe this argumentation is usually a little bit constructed, but who knows? Police might seize all your devices, a GnuPG library bug might affect all stored keys at the same time, ...

As there are few disadvantages and low cost for doing so, there isn't really a reason against.

Do you see any such media, or are any of my assumptions wrong? Why and where do you store your revoke certif on its own?

I store my revocation certificate (apart from a digital version, which is backed up digitally) on a piece of paper: qrencode is a great thing, just don't forget to add a note what this is and how it was created. And verify you can read it, I was having problems using some readers. A revocation certificate fits rather well on a DIN A4/letter format piece of paper, and could even still be read using smartphones.