Creating the perfect GPG keypair

Subkeys help protect your identity in case of private key (laptop) theft

Creating your initial keypair: gpg --full-generate-key
Adding a picture:
```
gpg --edit-key
gpg> addphoto
gpg> save
```
Strengthening hash preferences: gpg> setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
Adding a new signing subkey: gpg> addkey, then select RSA (sign only)
Creating a revocation certificate: gpg --output \<bilbo@shire.org\>.gpg-revocation-certificate --gen-revoke bilbo@shire.org

Exporting the final product:

gpg --export-secret-keys --armor bilbo@shire.org > \<bilbo@shire.org\>.private.gpg-key
gpg --export --armor bilbo@shire.org > \<bilbo@shire.org\>.public.gpg-key

Transforming your master keypair into your laptop keypair

Export all of the subkeys from our new keypair to a file: gpg --export-secret-subkeys bilbo@shire.org > /tmp/gpg/subkeys
Delete the original signing subkey from the keypair in our keyring: gpg --delete-secret-key bilbo@shire.org
Re-import the keys we exported: gpg --import /tmp/gpg/subkeys

In case of emergency

Unlock your safe-deposit box and get your master keypair out.
Boot a live USB of Ubuntu or your distro of choice. Then, import your master keypair into the live USB’s keyring: gpg --import /path/to/\<bilbo@shire.org\>.public.gpg-key /path/to/\<bilbo@shire.org\>.private.gpg-key
Now use gpg --edit-key to interactively revoke your subkeys: gpg> revkey
Now that your subkey has been revoked, you have to tell the world about it by distributing your key to a keyserver.