One more trick that I really like: using an SSH agent. On Gnome-based systems, Seahorse provides one (sometimes you have to install seahorse-plugins to get it); otherwise, gpg-agent can be an ssh agent. Pageant on Windows, and I'm not sure what's available on Mac.
SSH agents let you keep your key encrypted while only needing to enter your passphrase on first use (with the default ssh-agent, you must load the key manually with ssh-add; gpg-agent and seahorse both prompt you the first time it's needed). Add that to SSH agent forwarding (where multi-hop SSH connections authenticate using the agent on the originating machine, and your key is (A) only on the local machine and (B) encrypted when not in use.
Comments
One more trick that I really like: using an SSH agent. On Gnome-based systems, Seahorse provides one (sometimes you have to install seahorse-plugins to get it); otherwise, gpg-agent can be an ssh agent. Pageant on Windows, and I'm not sure what's available on Mac.
SSH agents let you keep your key encrypted while only needing to enter your passphrase on first use (with the default ssh-agent, you must load the key manually with ssh-add; gpg-agent and seahorse both prompt you the first time it's needed). Add that to SSH agent forwarding (where multi-hop SSH connections authenticate using the agent on the originating machine, and your key is (A) only on the local machine and (B) encrypted when not in use.