If subkeys are useful, does GnuPG have sub-sub-keys as well?

The current implementation of GnuPG feels a bit rigid, in that it only allows a two-level key management and subkeys are closely affiliated to their master key, have their own special names (sub and ssb instead of pub and sec), and enjoy not being listed by --list-keys by default.

Given that subkeys are also full-fledged keys, why doesn't GnuPG simply treat subkeys as normal keys and let users themselves decide how they wish to use their keys? They can use the following schemes:

  • a single key,
  • a master key + a subkey,
  • a master key + multiple subkeys,
  • a master key + multiple subkeys + multiple subsubkeys,
  • etc.

Quite some flexibility.

The other question asks about how to manage sons. This one asks about whether it should have grandsons.

  • 1
    @J.A.K. That one is about how to manage sons. This one is about whether we should have grandsons.
    – Cyker
    Commented Nov 29, 2016 at 12:13
  • my bad, i did read it, but apparently not careful enough.
    – J.A.K.
    Commented Nov 29, 2016 at 15:17
  • 1
    Possible duplicate of How to manage subkeys in gnupg?
    – Xander
    Commented Nov 29, 2016 at 20:56
  • 1
    @Xander That's exactly the deleted comment.
    – Cyker
    Commented Nov 30, 2016 at 0:05

1 Answer 1


No, it does not have such a concept, but the concept you describe sounds like a set of primary keys put into relation by certifications, at least as long as you don't add a more specific use case.

The additional flexibility you describe also brings complexity in implementation and usage, but at the same time is not considered relevant for the usual use cases of OpenPGP: one identity is a primary key, and subkeys are used for day-to-day tasks to minimize the primary key's exposure.

Concepts in information security should stay as simple as possible to keep solutions easy to maintain and secure.

For usage that requires more hierarchical key management like one could imagine for corporations where employees have their own keys, but the company should be able to put trust on and revoke them, use the normal OpenPGP features as certifications and designated revokers.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .