We have a bunch of SSH, GPG, SSL and other private keys that, obviously:
- must only be available to the smallest number of people possible
- can't be "lost" if a hard drive dies or the building burns down (because a lot of data would otherwise be undecipherable)
- must be recoverable even if the guy in charge is out sick or gets hit by the bus or holds out for a million-dollar raise
What are the best practices here? Do you store them on a bunch of flash USB sticks in a safe? Do you make copies? How many copies, and how do make sure they stay in sync (keys expire, get replaced, new keys are added etc.) Do you encrypt them? (with what, and how do you bootstrap?)
I've failed to turn up any useful practical info, so I'm interested in all experiences, good, bad, etc. from which we could learn.
Also, is there any open-source software that helps with this?