I'm new to using GnuPG and trying to understand how best to use it. I've reviewed Short, easy to understand explanation of GPG/PGP for nontechnical people?, but most guides explain PGP with a single-machine perspective.
I want to use GnuPG on three computing devices: a Linux PC, a Linux laptop, and an Android phone.
The fundamental use case is encrypting/decrypting email managed by an IMAP service, so all devices need the same private key for decryption.
I figure my choices are:
Just copy all my keys to the keyring on each device and rely mainly on the private key password for protection.
Create a master key (with --gen-key) to represent my identity, then create a separate disposable key (again with --gen-key) for encrypting/decrypting emails and signed with the master key. The former resides only on my PC, the latter is distributed to each device. As long as my mobile devices are not compromised, then the disposable key remains valid.
I may be overly paranoid and making this more complicated than it has to be, but humor me, please. I believe in not putting all your eggs in one basket.
The master key is supposed to be my digital identity. A lot of effort will be spent building trust around that identity, and I'd rather suffer the inconvenience of my paranoia than lose my key from carelessness and have to build trust around a new master key (maybe this isn't as bad as I think, but I am new to this).
I'm more likely to lose my laptop or my phone than my PC. If loss == compromise, then I'd rather lose an disposable key-pair (which I can revoke) than my master key-pair. I can always bestow the trust of my master key upon a new disposable key.
Sorry for the really long question. :-)
Is a password sufficient protection for storing my master private key across multiple devices?
Is my plan for option #2 feasible? Did I get something wrong or can it be improved?
If option #2 is a bad idea, then what are the best practices when using GnuPG for a single user across multiple devices?