Hacker News Reader

Best practice:

Use SSH keys for SSH connections and authentication

Use PGP keys for email encryption and file signing

Keep these systems separate as they're designed for different purposes

PGP is hairy and many developers don't have it installed and configured. It's full of non-obvious options and capabilities.

SSH is a common tool which most developers have installed, keep in a working order, use often, and reasonably understand.

Guess which tool is easier to piggyback on and achieve easier and faster adoption.

I like PGP keys for ssh auth because they can be hardware backed through openPGP. That makes it a great option (and also the actual crypto is then executed on the key itself, not by the gpg software)

You can do this with ssh keys too. And ssh keys can sign git commits. There’s no reason these days to even install a pgp suite. Stop using it.

Reply on news.ycombinator.com