According to a number of articles, e.g. "Creating the Perfect GPG Keypair," it is advisable to have a number of subkeys in your GPG key, one for encryption, and one for signing, and then to (a) back up your keys as well as a revocation certificate [ideally on paper too] and (b) remove the "primary" signing secret key from your laptop, so that
gpg -K returns:
/home/bilbo/.gnupg/secring.gpg ----------------------------- sec# 4096R/488BA441 2013-03-13 uid Bilbo Baggins <firstname.lastname@example.org> ssb 4096R/69B0EA85 2013-03-13 ssb 4096R/C24C2CDA 2013-03-13
... with the goal being that if your laptop is stolen you can properly revoke the keys.
I use Filevault 2 on my Mac & also have a firmware password -- so hopefully if my laptop is stolen or lost, I won't have to be concerned that someone will be able to access the data. Is it truly necessary to remove the primary signing secret key? I'm mostly concerned that I will lose the backups of the secret key and thus lose access to the keys.