GPG key handling with Server

Question

I'm using a VPS as a development machine and need gpg a) for signing git commits or e-mails (using mutt on the server) and b) for decrypting f.e. encrypted dotfiles and other files. But I don't feel really comfortable with uploading my private key to the VPS (even though it has a password). So I've read in the Debian wiki that you can create a subkey for signing - but not one for encrypting (which would be the ideal solution of course).

So is it possible to create a completely new gpg keypair on the VPS, so that I can use this one for b) but import the newly created signing subkey for a) instead of the "normal" subkey of the VPS keypair?

Answer 1

I'm no expert, but I think what you're talking about will work. For keys A = current keypair, B = new signing key, and C = new encryption keypair on the VPS:

From whatever machine holds your primary keypair

gpg2 --edit-key A8675309
addkey <follow prompts to generate signing key>
gpg2 -K <list keys, find new key's handle>
gpg2 -a -o signingKey.sec.asc --export-secret-key B8675309

I think you only need to import the secret key on the other side, might be wrong on that. Next get your exported signing key to the VPS, then

From your VPS

gpg2 --gen-key
gpg2 --import signingKey.sec.asc
gpg2 -a -o vpskey.pub.asc --export C8675309

After that you just need to get vpskey.pub.asc to your main box and

gpg2 --import vpskey.pub.asc

and use that key to encrypt anything you'll need to send to the VPS. You need to be careful with how you get the keys moved between machines, but personally I'd feel safe using SCP.