This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my public key (which they've obtained out-of-band in a secure manner) and the signature and verify the document remains unaltered. So far so good.
But if the verification step only happens some time later, and in the mean time I revoke my key, how should this be handled?
On the one hand, the file was signed in good faith at a particular time and if the file is somehow timestamped and the timestamp is before the date of revocation and the revocation is not because of a compromised key, then the revocation shouldn't automatically mean distrust of the signature.
On the other hand, assuming the key was revoked because it was compromised, someone else could have used my compromised private key to sign a file with a false timestamp within the placing in within the active period of the key.
As far as I understand, the longer a key stays 'active' the less secure it gets, because the more time there has been to brute force it and the more it has signed/encrypted, the more information is available to use in various attacks. Now I understand that theoretically brute forcing a key should take longer than it will take for the universe to suffer heat death, but it's always possible that short cuts may be found in the future. So I imagine one would want to revoke keys regularly.
Is there a way to tell the difference between the two situations described above?
Is there way to tell the differences between a revocation because of cycling and a revocation because of compromise?
It seems (from this question) that regular key revocation is not longer best practice, but I'm not 100% sure I'm reading that right. Instead Trust-on-first-use and "pinning" are used in practice today. Also the answers and comments in said question make it clear that there's no mechanism to expire a key. Having done some brief reading on TOFU and pinning though, and it doesn't seem to influence my question.
To prevent this being closed with an "XY" complaint, let me be more explicit. In the situation of a compromised key mentioned above, I can't think of of a way to reliably verify the document even though it was signed by an at-the-time uncompromised key. This could very easily be a gap in my knowledge, and I want to know if there are techniques to still do this reliably?