best practices for PGP keys (was: Re: [FOSDEM] GPG keysigning)