I already understand the desire to segregate a PGP master key from subkeys, allowing me to keep the master key in some off-site non-networked location while making use of the subkeys to do things like encryption and authentication. I also understand that I can then revoke the subkeys later if they are lost or compromised, allowing me to maintain my identity within the web of trust while being forced to shift to new keys.
The model I've seen employed so far looks like the master key is used to sign others' keys. This has the unfortunate side effect of necessitating that I take the master key out of cold storage any time I choose to sign a key. While I do not think this will be a frequent activity, I would like to minimize my interaction with the master key as much as possible.
Can a subordinate key be used to sign others' keys instead? I know I can create the signing key, but specifically the two important points to this are:
- Others that trust my master key's signatures will trust these signatures that were created from the subordinate key
- If the subordinate key is lost or compromised, can I revoke the subordinate key in a way that either (a) invalidates all signatures it has ever made or (b) invalidates all signatures made after a certain date. While (b) would be preferable, it's fairly trivial to let (a) happen and then just re-sign the keys I still want with a new subordinate signing key.
I think #2 is a given. The #1 is primarily what I'm not sure about. When computing the trust path to a target, are my subordinate signatures taken into account? And furthermore, does this model even make sense?