Re: [PATCH 0/7] Remove expired keys, 2024 edition

On Tue, Aug 05, 2025 at 09:59:01AM +0200, Uwe Kleine-König wrote:
> Hello,
> 
> this cleanup series removes 5 keys and one subkey that expired in 2024.
> Also a key that was revoked in 2020 is dropped.

Thanks for doing this work.

> None of the removed keys is part of trust paths to other keys, so there
> is no effect on the remaining keys.
> 
> I suggest to not apply this series straight away to give the affected
> owners the chance to extend the expiry date of their keys and replace
> them accordingly.

I agree, I will wait for at least a week before I act on this series.

> A bit orthogonal to this series: It is usually recommended to have an
> expiry date on PGP keys. Most keys (472 of now 620) don't have an expiry
> date, I wonder if that would be sensible to require at least for new
> keys added to the keyring. The upside would be that we don't trust keys
> that are already long abondoned. E.g. Gentoo requires that for the keys
> that are relevant for the project[1].

I don't really feel strongly one way or another (clearly, since I don't have
an expiration date on my own key either :)). From my perspective, the
hassle of dealing with expired keys outweighs the security benefits this
feature offers.

-K