>> One way to expire keys is to simply declare that any old PGP key more >> than two years old is expired. >No, this is a bad idea. Any arbitrary setting of expire time by the >keyserver is a bad idea. The idea wasn't just the keyserver, but PGP itself. If we set the time to three years, the earliest that will be is September 1995. A future version of PGP can enforce this. Eric