Gpgtools GPG Keychain Access

Since GPG Suite 2015.06 a revocation certificate is created whenever a new key is created.
Before, when a user lost their secret key there was nothing they could do about it, since only very few have created a revocation certificate.
With this change at least they could revoke their key and tell other users they should no longer be using their key and instead use a new one.

With laptops being used by many users however, it's not safe to keep the revocation certificate on that laptop, since an attacker might get access to both the secret key and the revocation certificate.
While the secret key is probably protected by a password, they could still abuse the revocation certificate.

In the future we should inform the user that a revocation certificate has been created, whenever they create a new key, why that is helpful but also why it's a potential security risk to keep it on the internal hard drive and guide them through a process to move it onto a USB drive or other external medium.

In addition, periodical checks should see if revocation certificates are on the hard drive and remind the user to move it onto an external medium.