Security Tutorial: PGP Key Rotation Best Practices for Marketplace Users 2026

Most marketplace PGP advice stops at “generate a key, back up the private one.” That is the easy part. The hard part is what happens six months later, when the same key has been used across two markets, a forum account, and a jabber handle, and one of those platforms quietly disappears with the admin’s laptop. Rotation is the practice nobody writes about because it is boring, manual, and slightly annoying. It is also the single control that limits blast radius when a key you trusted turns out to be a key someone else has.

Rotate on trigger, not on a schedule you won’t keep

I don’t believe in “rotate every 90 days” for PGP the way you’d rotate a cloud secret. The threat model is different. Your key isn’t sitting in a config file somebody can scrape; it’s in your keyring. Rotation matters when the trust around that key changes. Treat these as triggers:

• A market you registered on has been seized, exit-scammed, or gone dark without explanation.
• A vendor you’ve corresponded with had their account compromised or their key suddenly “replaced” via an unsigned message.
• You’ve used the key on a platform you no longer want to associate with that identity.
• You suspect your device, clipboard, or keyring was exposed, even briefly.

Cloud incident guidance for 2026 keeps saying the same thing: assume credential exposure and rotate aggressively across every layer. That advice maps cleanly here. If a platform you used your key on is compromised, assume the association is burned.

Generate a fresh key the right way

Don’t edit an old key to add a new UID and call it rotation. A new UID on a leaked key still carries the compromised identity. Generate a genuinely new pair.

Modern OpenPGP tooling makes this painless. The current OpenPGP spec is RFC 9580, which obsoleted RFC 4880, and current software generates Ed25519 + X25519 by default. You don’t need to pick algorithm types, key sizes, or expiration dates manually; secure defaults exist for a reason. If you’re on the command line, gpg --full-generate-key works, but pick Ed25519 if your GPG version supports it.

On expiration: a real but reachable expiry date is a good forcing function. Eighteen months to two years is a reasonable span for a marketplace identity that you’re actively rebuilding. Infinite expiry is a red flag unless you have a specific reason.

One caveat I’ll state plainly: your new key’s User ID gets embedded in the public key block. Use a throwaway name and email, not your real one. That is basic, but it is the step people skip.

Exchange and verify, or don’t bother rotating

A rotated key only helps if the people you talk to know the new one is really yours. Publish it somewhere the counterparty can independently reach, and exchange out of band via a channel you both trust.

Verification matters because a fake-key substitution is the classic man-in-the-middle play: someone hands you a public key that isn’t the other party’s, encrypts to the wrong key, and intercepts. The whole reason PGP exists is to close that gap, so verify the fingerprint through a second channel (a signed message from an already-verified contact, a previously-established out-of-band note) rather than trusting the first key block that shows up.

Export the new public key in ASCII-armored format and share it anywhere text travels. Never, under any circumstances, share the private key. That’s the one rule with no exceptions.

Retire the old key cleanly

Killing an old key isn’t as simple as deleting it. If the old key was ever linked to a marketplace account, that association doesn’t disappear when you stop using it. Plan for a transition window: keep the old key available to decrypt messages already encrypted to it, but stop advertising it, stop signing new messages with it, and tell your established contacts to switch.

What you cannot do is revoke the key on a marketplace you’ve been locked out of. If the market’s gone, the old key stays trusted by whoever still has it. That is a hard limit of PGP in a marketplace context, and I’d rather state it than pretend rotation is a clean reset. It isn’t. Rotation limits future exposure; it doesn’t undo past association.

Eliminate long-lived credentials everywhere, not just PGP

PGP rotation is one node in a broader habit. The 2026 cloud-security lesson is blunt: long-lived credentials are the thing attackers target, and the fix is to eliminate them rather than just rotate on a schedule someone forgets. The same instinct applies to your OPSEC. If you have a static password, a never-changing jabber handle, or a signing key used “just in case,” treat each one as a liability.

Identity-first controls matter here too. MFA, session revocation, and disabling compromised accounts immediately are baseline controls, not optional add-ons. For PGP that means the same discipline: if a key or associated account is burned, cut it off in one move rather than hanging onto it out of laziness.

Practical tooling

Use what fits your threat model. The KeychainPGP web app runs entirely in-browser via WebAssembly compiled from Rust; nothing goes to a server, which is what you want for any key touched by a marketplace identity. The desktop app adds clipboard auto-clear, which matters because a PGP block sitting in your clipboard is a leak waiting to happen. The CLI is useful if you’re scripting key generation or verification.

GnuPG remains the reference implementation and is fine. Power without hand-holding, that’s all.

A short rotation checklist

• Trigger identified? Note which key, which platforms, what was exposed.
• New key generated with a throwaway UID and Ed25519/X25519 defaults.
• Fingerprint verified through a second channel before anyone trusts the key.
• Old key transitioned: kept for decryption, retired for signing and advertising.
• Contacts notified and updated.
• Old private key archived securely or destroyed if exposure is confirmed.

None of this is glamorous. It’s the difference between a leaked key that costs you one identity and a leaked key that costs you the whole pattern behind it. Rotate on contact, verify the switch, and don’t pretend an old key can be un-leaked. This article is for research and defensive purposes only; no links to live markets and no access instructions are provided.