I have an existing OpenPGP key which has been used infrequently. All capabilities appear to be bound to the master key, there are no subkeys.
/home/user/.gnupg/pubring.gpg ------------------------------ sec rsa4096 2014-06-02 [SCE] [expires: 2017-06-23] .. key details, no subkeys ..
I would like to move to a subkey for signing and a subkey for encryption, as documented by Debian. This will allow me to use a smart card and store the master key offline.
With the following background:
- There is no indication any keys have been compromised, I just want to improve overall security by not having the master key on my PC.
- I haven't used the key to sign anything.
- I don't mind if I can't decrypt old data.
Can I generate two subkeys, remove the sign/encrypt capabilities from the master and keep using this key? Or is there a compelling reason to generate a completely new key with a transition statement?