gpg_qr_backup.sh

#!/bin/bash
set -euo pipefail

mktempfile() {
    tmpfile=$(mktemp --tmpdir=/tmp "$1")
    echo "Created $tmpfile" >/dev/tty
    printf "%s" "$tmpfile"
}

KEY_NAME="${1:-}"
if [[ -z "$KEY_NAME" ]]; then
    echo "Please supply a key to backup" >&2
    exit 1
fi

GPG_TTY=$(tty)
export GPG_TTY

KEY_EXPORT_B64=$(mktempfile "key-XXXXXXX.base64")
trap 'echo shredding exported key; shred -u $KEY_EXPORT_B64' EXIT

gpg --export-secret-keys -a --export-options export-minimal "$KEY_NAME" | base64 > "$KEY_EXPORT_B64"

# shellcheck disable=SC2016
split -d -C 2506 "$KEY_EXPORT_B64" --filter='qrencode -o ${FILE}.png' private-qr-
trap "echo shredding qr images; shred -u private-qr-*.png" EXIT

# All into one single image
montage -mode Concatenate -tile 2x private-qr-*.png keyring-qr-codes.png