If we assume that your random number generator isn't completely borked, then

> what's the chance of two PGP keys being exactly identical?

can be answered with *approximately something raised to the power of negative infinity.* Or in other words: it's not going to happen.

We can work this out by assuming that an "average" PGP public key uses a 2048-bit RSA modulus. Because at least the first bit of the modulus must always be 1, the effective modulus length is one bit shorter. (The exact technical and mathematical discussion behind this is a little more involved, but this should be good enough for now.)

I don't know how common products of two prime numbers are in that range, but let's be generous and put the probability of any random number in that range being a product of exactly two primes at 10^-10. 10^-10 is about 2^-33. This is the ratio of any random number in the desired range to actual valid RSA moduli in that range.

Hence, the combined effect is to effectively reduce the number of possible moduli by some 34 bits compared to if we were just to pick a number of sufficient length at random. (Because of the magnitude of these numbers, the decimal fractions simply aren't relevant here.)

Hence, we go from 2^2048 to 2^2014 (or thereabouts) *possible RSA moduli.*

Let's say ten million keys are generated every day. This is probably on the high side, but again, we're playing generous. Again, that's about 2^33 keys. Let's also say that we're doing this for 100 years, and only care whether two keys come out to have the same moduli (we don't need to store them, or compare them to each other, or anything else like that, because all of that adds overhead to our process that is customarily ignored in cryptographic theory). 2^33 * 365 (days) * 100 (years) ~ 2^48. We have shaved an additional effective 48 bits, coming out to 2^1966. Even if we assume *billions* of keys per day, that only shaves of an additional three orders of magnitude (corresponding to 30 bits) or so.

We conclude that the probability of, over 100 years and assuming that we *properly* generate ten million keys per day, leading to two keys being generated to have the same modulus thus comes out to about 2^-1966 or 10^-592. The number 2^-1966 can be compared to that [by the year 2040, we might just barely be able to *count* up to 2^138 in ten years](http://security.stackexchange.com/a/6149/2138). It's a long way up the exponential curve from 2^138 to 2^1966, and we'd still have to actually *do* something with each counted number (like, say, generate a RSA key).

If you don't want to take [the easy route](https://xkcd.com/538/), then even as hard as it is, factoring the modulus is going to be much, *much* easier than relying on random chance to give you a duplicate key. And besides rubber hose cryptography, factoring rather than pure random coincidence is the threat you need to worry about. Figures vary between different estimates, but at present, [2048-bit RSA is estimated to give about 100-130 bits of security](http://www.keylength.com/en/compare/).