Say I have several different email accounts and I want to use a different encryption key for each of them but still have them all certified under one identity. Is this a good idea and how would I do it?
Jon Doe (identity; key stored on encrypted external drive) certifies
- firstname.lastname@example.org (personal conversations only; key stored on trusted Linux machine)
- email@example.com (conversations with random people; key stored on potentially unsafe Windows machine) and
- firstname.lastname@example.org (business conversations; key stored on Windows machine that I have no control over)
The idea is to have a different encryption key on every device (which is also tied to an account), so if one gets compromised the other accounts are not affected, but my conversation partners would still only have to verify one public key and automatically have my other public keys certified (if, for example, someone would like to converse with me on both my personal and business address).
My first attempt was to add multiple UIDs (email addresses) and encryption subkeys to a keypair but I soon realized that UIDs belong to the public key and clients by default would only use the most recent encryption key (also see Debian article on how to use a subkey for signing).
My current idea would be to generate a sign-only public key (sign + certify), the root identity, and separate keypairs for each email account (sign + encrypt) and then either certify the keypairs (how?) or build a small web of trust (by setting the trust level
"ultimate" "trusted" from the email account keypairs to the sign-only public key?). Is this the way to do it, how would you do it and how can your conversation partners import all of my email public keys by only publishing my master identity?
Also I like to point out this GPG tutorial which argues against using such a type of scheme. The argument being, if I understood it correctly, that you should be more careful with your private key in the first place because users never check revocations anyway. Okay, great, so if my private key is compromised once I'm pretty much screwed with the PGP system? And then again, what's the use of creating a new identity/reputation (Jon Doe the 2nd) if users don't get notified about the revocation of my first identity anyway? I might as well send them a revocation certificate and the new public keys, which are still certified by my old root identity.