I want to understand how, using standard tools like openssl (or similar), to derive a child RSA key pair from an existing RSA key pair. Additionally I would like the derived key to contain a reference to it's parent such that the relationship could be verified using the same tools used to create it.
From my research so far it seems like the methodology is to sign an arbitrary value with the parent key and use the result as the derived child key. However, the output of
openssl dgst -sign master.pem is not an RSA key but ciphertext. If I'm on the right track, how then do I transform the ciphertext into a private key or key pair (I understand the public key can be generated from the private key).
If that is not the correct way, what should I do instead?
This question seems to be hinting at what I want but does not provide enough detail (at least for my understanding).