The best practice of master/sub key capabilities

[Dongsheng Song]

Hi all,

When I create new master/sub key, in the following 2 choice, I'm
wondering which is better?

1) master key have SCEA capabilities

sec  rsa4096/A19676A1
     created: 2015-08-20  expires: never       usage: SCEA
     trust: ultimate      validity: ultimate
ssb  rsa4096/27ADD750
     created: 2015-08-20  expires: never       usage: SEA

2) master key have only Certify capability

sec  rsa4096/1F8AFCAD
     created: 2015-08-20  expires: never       usage: C
     trust: ultimate      validity: ultimate
ssb  rsa4096/8E1D2A87
     created: 2015-08-20  expires: never       usage: SEA

Regards,
Dongsheng