Suppose I have a PGP key set up as follows:
I have an offline master public/private keypair, which is set to only Certify, aka create subkeys and sign other people's keys.
Then I create three subkeys which I put on a Yubikey (with offline backups):
- Signing key
- Encryption key
- Authentication key
The signing key will be used to sign messages and git commits.
The encryption key will be used for people to send me encrypted messages.
The authentication key will be used with
gpg-agent --enable-ssh-support to use as ssh authentication to log into servers.
My question is:
Are there any negative (or positive?) security implications to publishing the authentication subkey (or all three public subkeys) to a keyserver?
My logic is that I'd only really need to publish the signing public subkey, so people can confirm my signatures, and my encryption public subkey, so people can send me encrypted messages.
No one from "the public" needs to know that I even have an authentication key because it will only be used in the
authorized_keys file of my servers to allow me to log in without a password.
If someone were to break into a server and query the public keys in the
authorized_keys file, they could look that up in the keyserver and find out that I, specifically, am using that server. Is this problematic or am I overthinking things?