Only listened to the first third yet (nice talk so far, questions from the audience are a little hard to understand) but I've thought the eight character key IDs aren't enough nowadays b/c it's too easy to create a keypair that has the same first eight chars of an ID. I think there was something Debian-related about this a few years back.

In the meantime I came across those two helpful links regarding GPG/PGP:
  - why you should use subkeys: https://wiki.debian.org/Subkeys
  - a "best practices" for OpenPGP: https://we.riseup.net/riseuplabs+paow/openpgp-best-practices ([EDIT: replaced by https://help.riseup.net/en/security/message-security/openpgp/gpg-best-practices)

keep up the good work!