There needs to be tools and documentation for key managment with Obnam.

How does not one replace one's key, or subkey, when it expires?