Storing private keys directly in a keyring Storing an RSA 2048-bit key directly in a keyring seems to work fine, and is advantageous because the application can be removed, broken, reinstalled and the key still works.

However, most apps seem to write out PCSS8 key files, and, instead, keep the random AES keys in the keyring for acccess.

Is there a good reason not to store the private keys directly in a properly encrypted user keyring?
Is there a good reason not to store the private keys directly in a properly encrypted user keyring?


maybe generic answers what are you looking are standardization and platform independence. When writing software, we (mostly) need to take care that it will eventually running on all platforms. PKCS#8 is widely accepted standard usable everywhere.

What can be important here is the context. Are the keys directly used by user (to decrypt/sign something) or by machine (service)?

When we consider the end-user context, I agree with Maarten's comment, IMHO the best option is to have the keys on hardware. (Any reasonable crypto-device is often exposed as PKCS#11). Otherwise there is no advantage of Keyring over other keystores (ok, it can be integrated with UI such as Gnome)

When using the keys from the services, PKCS#8 is well supported and widely accepted standard, so it works everywhere. And the private key may be encrypted, but the decryption key needs to be available somewere too for server side services.