Why does a Revoked PGP Key show under my Valid Key?

Question

TL;DR

As you can see, I revoked keyid 178AA2B7 recently.

pub  4096R/178AA2B7 2014-08-13            
sig revok  178AA2B7 2014-08-13 __________ __________ [selfsig]
     Fingerprint=321F 31A7 BB1B 60C7 490F  B80B 2809 4F6A 178A A2B7 

uid Eric Duncan (eduncan911) <ed****[email protected]>
sig  sig3  178AA2B7 2014-08-13 __________ __________ [selfsig]
sig  sig3  178AA2B7 2014-08-13 __________ __________ [selfsig]

sub  4096R/0AD3364B 2014-08-13            
sig sbind  178AA2B7 2014-08-13 __________ __________ []

But why does 178AA2B7 show up under my valid/primary/active key?

pub  4096R/A510AA8C 2014-08-13            
     Fingerprint=78A9 13EA AF81 2415 4B50  0B2A 5CE0 F95A A510 AA8C 

uid Eric Duncan (eduncan911) <me@ed****n911.com>
sig  sig3  A510AA8C 2014-08-13 __________ __________ [selfsig]
sig  sig3  A510AA8C 2014-08-13 __________ __________ [selfsig]
sig  sig   178AA2B7 2014-08-13 __________ __________ Eric Duncan (eduncan911) <ed****[email protected]>
sig  sig3  A510AA8C 2017-06-26 __________ __________ [selfsig]

uid Eric Duncan (eduncan911) <ed****[email protected]>
sig  sig3  A510AA8C 2017-06-23 __________ __________ [selfsig]

uat [contents omitted]
sig  sig3  A510AA8C 2017-06-23 __________ __________ [selfsig]

sub  4096R/E08B9994 2014-08-13            
sig sbind  A510AA8C 2014-08-13 __________ __________ []
sig sbind  A510AA8C 2017-06-27 __________ 2018-06-27 []

sub  4096R/8666E626 2017-06-27            
sig sbind  A510AA8C 2017-06-27 __________ 2018-06-27 []

More to the point... How do I get rid of it? I've tried editing the key but I cannot see it in any of the prefs or uids or subkeys.

(To see the full output, see this link: http://pgp.mit.edu/pks/lookup?search=eduncan911&op=vindex&fingerprint=on )

---

I created my identity a few years ago with two separate PGP keys. Only recently did I find out about the ability to add multiple uids to a single key. So I have added my two email addresses to the primary key I have been using, and published in the WOT.

I also revoked one of my original keys - as I never used it.

http://pgp.mit.edu/pks/lookup?search=eduncan911&op=vindex&fingerprint=on

But as you can see, it shows under my primary key that is still valid.

Some additional information...

There was a piece of software once that I tried to import my private keys into (the two separate private keys from both accounts) and it always told me I had already imported a key for my @gmail address. It would never let me import both keys.

Now, I suspect I originally goof'd something up when I made those primary keys years ago.

Thanks!

Answer 1

You're looking at a certification (signature) that you issued from one of your keys to the other one. All the output you're looking at says is that there is a crytographically tested certification from the one key to the other, but it does not make any assumption on the validity of that key (whether it is verified, trusted and not revoked).

Two things considering OpenPGP are important here: OpenPGP is built to never forget anything to be resilient against deletion attacks and due to the distributed nature of the key server network (there is no way to delete information from the keyserver network, just mark it as revoked). And no certifications, ... are to be trusted unless verified through a so-called trust path from your own key to the key to be validated.

GnuPG will not account the revoked key any more when recalculating the trust database, no matter whether the signature is listed or not.

Deleting signatures is not really considered as use case in GnuPG. If you really want to delete it, you will have to decompose the public key using gpgsplit, search for the proper signature packet and recompose and import the public key again. But this is not really useful: as you cannot delete the signature from the key server network, next time you fetch your own key the signature will be added again.