[disiplus]

im still not convinced. if somebody breaks 2048bit we all have bigger problems. and if somebody compromises your mail server i assume you would like to know and not only let the keys rotate via cron and call it a day.

[brightball]

Either way, when you can solve the problem with an extra DNS entry it's a better solution.