If you mean air-gapped literally, that seems unuseful.
Wouldn't you want the keys on the computer that's going to use them? And then, wouldn't you want to make it hard to copy the unencrypted private keys?
(I'm assuming we're talking about SSH keys.)
OTOH, it could be neat to run an ssh agent in a key-holding qube and forward that to whatever qubes need to use your SSH keys, using `ssh-add -c` so that key use must be confirmed in the key-holding qube.
If they somehow break the encryption on your hard disk it’s just more security.. isn’t that what security’s all about? Getting the most safety you can get? What need is there to have an encrypted hard drive if your computer is air gapped? It’s just a better safer idea, no?
Security is not about getting the most safety you can get. Otherwise why stop there? You could store the password protected private key itself as an encrypted file on the encrypted disk, and add one more layer, or double-encrypt it and add yet another layer etc.
Wouldn't you want the keys on the computer that's going to use them? And then, wouldn't you want to make it hard to copy the unencrypted private keys?
(I'm assuming we're talking about SSH keys.)
OTOH, it could be neat to run an ssh agent in a key-holding qube and forward that to whatever qubes need to use your SSH keys, using `ssh-add -c` so that key use must be confirmed in the key-holding qube.