In the interest of safeguarding my master key I store it offline. I have a gpg subkey with indicator SEA that I keep available on my system. When I download software I verify it using the provided asc file and the developer's public key by importing his/her key into gpg and running
gpg --verify filename.asc filename
In the interest of eliminating the 'not certified with a trusted signature' warning I expected to be able to sign the developer's key with my subkey. However, I get the error
gpg: signing failed: No secret key
I tried to override the signing key with
gpg --local-user subkeyid! --lsign-key developer_keyid
but I still receive the same error. Is it possible to sign a developer's key with my subkey using gpg? If so, is it a good idea and why or why not?
Thanks in advance!