1. I recently re-generated some PGP keys in full-on paranoid, proper form (unnetworked live OS, masters stored offline, subkeys on smartcards, embedded JPEG). That part feels good.
1.a. I still have not found a proper solution to the "turn an existing PGP key into a subkey of another key" problem, which I need to do to consolidate UIDs. A lot of people have my old @lwn.net address; I would prefer to merge the identity in with my others.
2. That tangent aside, the op-sec problem now becomes "what exactly do I do to ensure the security of the storage device that has my master private key on it?" I find surprisingly little written about this topic.
On the one hand, I want to be able to access it whenever I feel like it, so locking up in a safety-deposit box is right out. But I'm also not the only person who can enter my current residence, so I feel like some sort of security is warranted.
3. That led me down the rabbithole of looking at tamper-evident storage products, which you can easily buy online. (I know are other options; this is just the one I wanted to talk about.) So, in theory, I could seal the storage up in a small box with a seal on it, and know afterward if anyone has opened the box while I was away.
However, what I can't figure out is how you could prevent an attacker from buying a set of identical tamper-evident seals on Amazon and just sticking a new one on the box after they clone the data off of the thumb drive or whatever.

And that problem seems to plague all tamper-evident storage options. What am I missing here?