I have some public keys of multiple users in my keyring in GnuPG. One of these users has switched to a new public key. I still have the user's old key which has an assigned trust of ultimate. I just assigned the same trust to his new key.He does not use the old key anymore. What should I do with the old key? Should I withdraw trust, or revoke it? What is the correct procedure in such a case?
What to do when a user switches to a new key?
gpg;pgp
First of all, ultimate trust shouldn't be used for other's keys, full trust is enough. If you issued ultimate trust to make the key itself valid, you missunderstood the web of trust concept. If you just wanted all his certifications to be valid for you (thus, extending your web of trust), full trust is enough, if you at the same time certified him.Regarding your actual question: this depends a little bit on the situation.You will not be able to revoke the other's key. Has the key's owner revoked it? If so, he should just send you the revocation certificate -- for example by uploading it to the key servers, where you can fetch it again. If the key is revoked, you do not have to care about trust any more anyway.The key owner has lost control over the key, but cannot revoke it any more. For example, somebody stole the laptop with the only copy of the key, and the owner doesn't have a revocation certificate (very bad idea). Now it's at you to fix the situation, by withdrawing trust and setting it to never. Also consider doing the same with his new key, as there seem to be major issues with the owner's key handling. This does not change validity if his key (if you signed it), it just makes sure certifications issued by it won't be used for validity calculation of others.The key owner just doesn't want to use the key any more, but still owns it and wants to keep the reputation in the web of trust he build up (which you probably also want to make use of): Just import his new key, and don't care about the old one at all. Apart from changing trust from ultimate to full.If you want to make sure you're not accidentially encrypting to his old key, disable it by running gpg --edit-key [key-id], then using GnuPG's disable command.