I'm following this tutorial to set up a debian repository
https://wiki.debian.org/SettingUpSignedAptRepositoryWithReprepro
This repository will be managed by me and my colleagues. We want to sign the packages and the repo itself, so I need a GPG key. Naturally I shouldn't use my own GPG key, otherwise my colleagues can't manage the repo. So I thought of creating a new GPG key specifically for this repository, and then share the private key with my colleagues.
Is this the correct way to have a repo managed by many people? I don't like the idea of sharing a private key (and I think it wouldn't scale well for repos managed by many people), but on the other hand I don't see another way this can be done.
I guess there's a simple solution but my lack of experience on this sort of server is not helping.
Edit: sharing a private key was mentioned here http://irtfweb.ifa.hawaii.edu/~lockhart/gpg/ (use case 2 at the very bottom)