One of the most secure and practical way to organize PGP keys is to use [Subkey with offline Master Key](https://wiki.debian.org/Subkeys).

In essence, with subkeys you store your (C)ertification key in an encrypted, trusted offline storage; and your day to day workstation only have the (S)igning and (E)ncryption key. You would only take out your (C) key when you need to sign or revoke someone's key, which usually happens much less often than regular signing and encrypting.

The reason why it's recommended to use separate (S) and (E) key is because you can only have one (E) key in all your devices if you want to be able to read all your encrypted data from any one of your devices, but you can use multiple (S) key, one for each of your device, and all of your devices can still verify the signature because they trust your master key.

Note that newer version of GPG creates (S) and (E) subkey by default.