Assume I have a universe of U users. Every user has his private key. I want to build user groups by adding a company sub key to his key set. Now users can sign his company sub key with there company sub keys.
Now the user resigns from the company. He is lazy and will not revoke his sub key right away, or he plays not fair, and will never revoke it. Ok, others could revoke their signatures after they have been notified that he left the company, but others may never revoke their signatures.
How can I assure that after he resigns, he will be dismissed from/denied access to the group?
Update: I found that PGP supports something called "Designated revoker". The definition for it is:
A designated revoker in OpenPGP is a partner key that we trust and that can be used to revoke our public key in the case when we have lost our own private key and cannot do the revocation ourselves.
Could that be a solution to my problem?