The OpenPGP (private) key format stores the key symmetrically encrypted. The "iterated and salted" setup derives this key from a passphrase, taking a "octet count" parameter that determines the complexity of expanding the passphrase into a symmetric key. With the highest value for this parameter (~65 million), key expansion takes about a second on my computer (GPG).
With this kind of setup, is it possible to make it hard enough to brute-force that it's sane to have the private-key publicly available?
I expect the answer depends on the passphrase complexity. E.g. if you somehow managed to have a passphrase with 256 bits of entropy, then an attacker would be better off just guessing the derived key instead of the passphrase - which in this case amounts to brute-forcing an AES key (which I'd consider hard enough to be "safe"). So the question might really be "how complex does your passphrase have to be to make this safe?".