I guess this means you have to upload your private key to the server. I always wonder what happens when the key is copied and used by someone else. Can you revoke the key? What happens to sent and received messages from the past? Do you still need the old key (private or public) to read those? Is there a private master key that can create a private sub key that can be used to upload to that server?
Encryption is also supported via a browser plugin, so it's not necessary to upload the private key to the server. Regarding your questions:
1) yes, you can revoke the key by generating a revocation certificate and publishing it on a public keyserver (of course, your correspondents would need to refresh the public key from the keyserver to know it was revoked, which is something they might not do);
2) sent and received messages from the past, unfortunately, are readable by the person who is in possession of the private key, if such key is not protected by a strong password;
3) yes, you still need the old private key to read the old messages;
4) you can generate a master key (to be kept strictly offline) and several, frequently rotating subkeys for encryption purposes. It's not a silver bullet solution (in the sense that a thief would still have access to all your subkeys, meaning he could read all your messages up to the point the keys are stolen, but it mitigates the damage somehow). See here: https://alexcabal.com/creating-the-perfect-gpg-keypair
Yes, you can revoke the key and publish the revocation. This means that it will be flagged as revoked in the server keys and assuming that senders keep their GPG keybase up to date with server keys, they'll get a warning that this key is out of date. All e-mails already encrypted with the key can still be decrypted though.
As for the second part of your post, you're probably asking about this:
If you generated a revocation certificate, yes, you can revoke it. Otherwise no. The private key is protected (should be) by a password, so even in the event it gets compromised it should be OK.
Encrypted messages from the past are unreadable, unless you have the private key. No private "master" that I know of.
If you don't use the browser extension you would probably only want to use this feature if you control that Roundcube instance yourself because yes if you upload it to the server and your key gets lost all past and future communication with that key is only as secure as your keys password.
