PGP key migration march 2025

provisioning steps

• generate new keys on air gapped machine using tails boot disk
• sign new key with old key
• create subkeys with expiry dates, separate for signing, encryption and authentication
• transfer subkey private keys on yubikey
• store root key air gapped and paper backup
• set expiration on old root key and old subkeys
• publish old public key
• publish new public keys

updating steps

• boot air gapped machine using tails boot disk
• decrypt and import backups
• set new expiry on subkeys
• create new key backups
• provision yubikey with updated subkeys
• publish updated sub keys

guides

• generating PGP keys using tails: https://github.com/sunknudsen/guides/tree/main/archive/how-to-generate-and-air-gap-pgp-private-keys-using-gnupg-tails-and-yubikey
• renew gpg keys https://gist.github.com/krisleech/760213ed287ea9da85521c7c9aac1df0

commands according to chatgpt

1. Backup Your Current Keyring (Important!)
gpg --export-secret-keys > secret-keys-backup.asc
gpg --export > public-keys-backup.asc
2. Generate a New Strong Primary Key
gpg --full-generate-key
Recommended choices:
Key type: RSA and RSA (or Ed25519 for ECC)
Key size: 4096 bits
Expiry: 1y or 2y (renew later as needed)
Take note of your new key ID (gpg --list-keys).
3. (Optional) Generate Subkeys for Encryption, Signing, Authentication
To isolate duties (good for minimizing risk):
gpg --edit-key YOUR_NEW_KEY_ID
Then inside GPG prompt:
addkey
Choose each subkey type as needed:
Sign: Use for signing
Encrypt: Use for encryption
Auth: Use for SSH, etc.
Repeat addkey for

---

5. Set the Old Key to Expire
gpg --edit-key OLDKEYID

Then in the prompt:
expire
Set the expiration to something in the past or near future (e.g., 1d).
save

7. Upload New Key to Keyservers or Distribute

gpg --keyserver hkps://keys.openpgp.org --send-keys NEWKEYID

And revoke or update the old key as appropriate.