So, I've generated my GPG key pair. Created a subkey for signing and a subkey for encryption. Exported the whole thing, removed my master key pair to a secure place, re-imported only the subkeys. Now, I take my fingerprint and passport to a signing party and folks verify my identity and go pull my key off a keyserver, sign it, and upload it back to the key server.

After refreshing my keys I now have their signature on my private subkey?

Does that mean upon receiving a signature from someone else I need to go get my master key pair and sign it with my private subkey or?

If I lose my laptop before transferring signatures to my main keypair they are lost forever?

  • 1
    $\begingroup$ The exported subkey carries information about the PGP master key, which is part of the signatures. The signatures are simply data, you can make backups of them too. $\endgroup$ – Natanael Aug 10 '19 at 10:07
  • $\begingroup$ Do I need to transfer those signatures back to my master keypair then or? $\endgroup$ – RhythmInk Aug 10 '19 at 19:07
  • $\begingroup$ you would probably need to use an import option in the PGP software to copy them over. Right now they will only be seen when you show the exported subkey. If you want them to be seen with the root key, you need to import to it. $\endgroup$ – Natanael Aug 10 '19 at 21:54
  • 1
    $\begingroup$ @Natanael Could you possibly create an answer out of your comments? $\endgroup$ – Maarten Bodewes Aug 13 '19 at 15:49
  • 1
    $\begingroup$ @MaartenBodewes perhaps later, would want to go through the spec so I can link and point to the right section $\endgroup$ – Natanael Aug 14 '19 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.