How to create unique GPG Keys for different environments / projects

Question

After searching and reading various documents it remains unclear to me as to an effective/straightforward manner to create/maintain multiple sets of GPG Keys.

I have a project that needs unique GPG Keys per environment and each user has their own GPG Key. Thus each server (environment) needs unique GPG keys.

I would envision the most secure and best practice is for each environment would have its own gpg --gen-key results for which to base its own private and public keys. From there an admin could add a user to each environment as needed.

Or am I just missing the point all together?

Answer 1

If you want to create separate key pairs that are not dependent on your personal keys, the easiest way is to use a separate GPG home directory for each. For example, to create keys for "projectB", first create an empty directory, then tell gpg to use that dir as its home:

mkdir projectB-gpg
gpg --homedir ./projectB-gpg --gen-key

That will do what you want, although you will now have the problem of distributing the private keys and passwords securely to each environment.