diff --git a/README.md b/README.md
index 680f7cd..66e749a 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,14 @@ gpg --import /path/to/keys/*.gpg.pub
 gpg --list-keys --keyid-format=long
 ```
 
+# EOL: Archive Expired Keys
+
+To mark a key as expired, move it to the `archive/` dir as follows:
+
+```bash
+mv ${keyname} "archive/${keyname}_$(date '+%Y-%m-%d').archive"
+```
+
 # Configure SOPS
 
 SOPS is used for encrypting secrets, e.g. credentials for various systems
@@ -64,4 +72,4 @@ sops -e -i secrets.yaml
 
 # decript, print to console
 sops -d secrets.yaml
-```
\ No newline at end of file
+```
diff --git a/archive/.gitignore b/archive/.gitignore
new file mode 100644
index 0000000..e69de29
diff --git a/joshua.kapfer@netgo.de.gpg.pub b/archive/joshua.kapfer@netgo.de.gpg.pub.2025.02.04.archived
similarity index 100%
rename from joshua.kapfer@netgo.de.gpg.pub
rename to archive/joshua.kapfer@netgo.de.gpg.pub.2025.02.04.archived
diff --git a/matthias.friedrich@netgo.de.gpg.pub b/archive/matthias.friedrich@netgo.de.gpg.pub
similarity index 100%
rename from matthias.friedrich@netgo.de.gpg.pub
rename to archive/matthias.friedrich@netgo.de.gpg.pub
diff --git a/sven.ketelsen@netgo.de.gpg.pub b/archive/sven.ketelsen@netgo.de.gpg.pub
similarity index 100%
rename from sven.ketelsen@netgo.de.gpg.pub
rename to archive/sven.ketelsen@netgo.de.gpg.pub