Understanding certificates for public keys with subkey

Question

I have a openpgp key with 3 subkeys:

> gpg --list-keys
<keyring-location>
-------------------------------
pub   rsa4096 2017-05-19 [SC] [expires: 2019-05-19]
      <key-id>
uid           [ultimate] <my-name> <my-email>
sub   rsa4096 2017-05-19 [E] [expires: 2019-05-19]
sub   rsa4096 2017-05-19 [S] [expires: 2019-05-19]
sub   rsa4096 2017-05-19 [A] [expires: 2019-05-19]

My goal: I want to create a certificate for my pulic key for authentication with strongswan.

Now when I export the key, I get:

> gpg  --armor --export <key-id>
-----BEGIN PGP PUBLIC KEY BLOCK-----
...
-----END PGP PUBLIC KEY BLOCK-----

My questions:

1. What is a public key block? Does it contain all my public keys?
2. How can I extract the public key of my authentication key so that I can create a certificate for it?
3. If I have a certificate, how can I check if it is for the authentication key?

Answer 1

1. The public key block is a structure that contains one public pgp key. However the structure does not only contain the public key, but more information such as public key algorithm, key expiration time and so on. Depending on what "key-id" you used with your export command, the public key block will contain the public key correponding to that "key-id".
2. It might be useful to see what information your pgp key contains so that you can extract your public key from it. You could use a site such as https://cirw.in/gpg-decoder/ to check all information contained inside your public gpg key block.
3. You could use your private key corresponding to your public key for which you created a certificate to sign a message (e.g. with OpenSSL). Then you could use the certificate, more specifically the public key inside that certificate, to check if the signature you created can be successfully verified. If so, you can be sure that the certificate matches your private gpg key.