- Can I revoke the signing subkey using the public key or do I need a copy of a private key as well?
No, you always need the private primary key for all key management operations (subkeys, user IDs, ... are all bound by signatures of the private primary key). Consider it was possible to do this using the public primary key, everybody would be able to revoke your key (as the public key is -- well, public).
- Should I delete the key from my keyring to have a clean list of keys or should I keep the revoked key (and why)?
Leave it there. The public key will get resynchronized anyway as soon as you update your key from the key servers. And the public key also carries the revocation information.
- How can I inform friends/colleagues about it? Do I email every one of them or is there a more massive approach? If they don't receive the
information, will they see for example my emails as "TRUSTED Good
signature from ..."?
"It depends". Some clients will automatically fetch the updated key when they receive the first mail signed with an unknown (sub)key, others won't.
If you're just doing key escrow and exchange keys in advance, consider creating the new key some weeks in advance to allow people fetching them up. I wouldn't bother people when creating new subkeys (especially signing subkeys) without a real revocation reason, they will realize they're missing the new key as soon as they receive a signed message. As you're taking advantage of subkeys, if they trusted your old key, they still trust your new one (trust and validity are assigned to primary keys, subkey validity is derived from the primary key).
If you suspect or are sure your private signing subkey got into the hands of an attacker, I'd indeed go out and mail those I signed/signed me and/or publish this information at relevant places (for example, if you're signing software).
