Why can GPG sign messages but not keys?

Question

I am trying to add local signatures to a few of the public keys I have in my keyring, but using gpg --lsign-key fails with the message "no secret key" despite the fact that gpg --sign works. I am using a Yubikey as a smart card.

GPG shows that the secret key is not available, but there is a signing key on the attached smart card:

$ gpg --list-secret-keys
sec#  rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
      Key fingerprint = DEAD BEEF DEAD BEEF DEAD  BEEF DEAD BEEF DEAD BEEF
uid                   [ultimate] My Name <me@example.com>
ssb>  rsa4096/0x8BADF00D8BADF00D 2000-01-01 [E] [expires: 2020-12-31]
ssb>  rsa4096/0xBADDCAFEBADDCAFE 2000-01-01 [S] [expires: 2020-12-31]
ssb>  rsa4096/0xFACEFEEDFACEFEED 2000-01-01 [A] [expires: 2020-12-31]

I can sign a message:

$ echo "test" | gpg --sign --armor
gpg: using "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF" as default secret key for signing
-----BEGIN PGP MESSAGE-----

[snipped signature]
-----END PGP MESSAGE-----

But I cannot --lsign-key:

$ gpg --lsign-key product-security@apple.com

pub  rsa4096/0x782F6D86DED32B71
     created: 2018-08-20  expires: 2019-08-20  usage: SC
     trust: marginal      validity: unknown
sub  rsa4096/0x1C3F44E9CB9F9E3A
     created: 2018-08-20  expires: 2019-08-20  usage: E
[ unknown] (1). Apple Product Security <product-security@apple.com>
[ unknown] (2)  Apple Product Security Notifications <product-security-noreply@lists.apple.com>

Really sign all user IDs? (y/N) y
gpg: using "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF" as default secret key for signing

pub  rsa4096/0x782F6D86DED32B71
     created: 2018-08-20  expires: 2019-08-20  usage: SC
     trust: marginal      validity: unknown
 Primary key fingerprint: 0CD5 C954 D089 2440 1598  9759 782F 6D86 DED3 2B71

     Apple Product Security <product-security@apple.com>
     Apple Product Security Notifications <product-security-noreply@lists.apple.com>

This key is due to expire on 2019-08-20.
Are you sure that you want to sign this key with your
key "My Name <me@example.com>" (0xDEADBEEFDEADBEEF)

The signature will be marked as non-exportable.

Really sign? (y/N) y
gpg: signing failed: No secret key
gpg: signing failed: No secret key

Key not changed so no update needed.

How can I add a signature to this key to validate it?

Answer 1

Signing and key signing is done by different subkeys. You have:

$ gpg --list-secret-keys
sec#  rsa4096/0xDEADBEEFDEADBEEF 2000-01-01 [SC]
      Key fingerprint = DEAD BEEF DEAD BEEF DEAD  BEEF DEAD BEEF DEAD BEEF
uid                   [ultimate] My Name <me@example.com>
ssb>  rsa4096/0x8BADF00D8BADF00D 2000-01-01 [E] [expires: 2020-12-31]
ssb>  rsa4096/0xBADDCAFEBADDCAFE 2000-01-01 [S] [expires: 2020-12-31]
ssb>  rsa4096/0xFACEFEEDFACEFEED 2000-01-01 [A] [expires: 2020-12-31]

Here, DEADBEEF is the key of the whole PGP key, valid for Signing and Certifying.

Then you have three subkeys (ssb = Secret SuBkeys), valid for Encryption, Signing and Authentication respectively (you could eg. have a single subkey valid for both Signing and Authentication, but these are all on different keys for you).

When you gpg --sign, you are using BADDCAFE, whereas for a gpg --lsign-key you would need DEADBEEF. That's why one works while the other doesn't.

Now, I'm not sure why it is failing, it may be that DEADBEEF is not there at all (do you have an offline backup of the full key?), or perhaps it's a bug when interacting with the smartcard, and it is "not finding it", although it is really stored there. An easy thing to review would be the number of slots that are supported by your smartcard, as on some of them you wouldn't even have enough slots for those four keys.