If they rotate the private key frequently, they need to keep all old keys in order to decrypt the messages. If they keep reusing the private key, why make new certificates all the time?

▲

kbolino a day ago | parent [-]

But you can't re-use the private key, and you can't keep the same one around for very long. In a thread about "why can't we do Let's Encrypt but for email", surely we must start by accepting one of the most important lessons of the modern WebPKI era, which is that CRLs and OCSP do not work at the scale involved here, which has led to keys and thus certificates being constantly rotated.

Somebody else already said "key management is the hardest problem" and I wholeheartedly agree.

	▲	kbolino 8 hours ago \| parent [-]
		I've looked at this question a bit more closely, and it seems that the Baseline Requirements for WebPKI do not require key rotation unless key compromise is known to have occurred. In other words, while you must get new certificates regularly, you can continue to use the same keypair for them, as long as it continues to meet the security requirements and you don't think it's been stolen. It seems they have judged certificate mis-issuance to be a much more likely threat than key theft. I'm not sure if that same premise would still apply to e-mail, but I wanted to make this correction.