Answer
It depends upon whether you have access to the public key corresponding to the signing private key.
By default, when you use generate
to create a private keyring on an OpenPGP Smartcard with GnuPG, the signing public key will be generated as part of that process and will be automatically added to your user's local keyring-for-public-keys, e.g. ~/.gnupg/pubring.gpg
. (From there, you can make backup copies for yourself and/or publish copies to keyservers, to minimise the risk of finding yourself without access to that public key in the future.) With this public key, and the Smartcard, in your possession, yes you can generate a revocation certificate.*
However, if, for any reason, you no longer have access to that public key, then no, you cannot generate a revocation certificate, because:
OpenPGP smart cards do not store enough information to reconstruct a full OpenPGP public key. (Source.)
Footnote
* In recent versions of GnuPG 2.x (and possibly of GnuPG 1.x - I haven't checked these), if a user uses generate
to create a private keyring on an OpenPGP Smartcard, then GnuPG automatically generates a revocation certificate and saves it to a file in the user's ~/.gnupg/openpgp-revocs.d/
directory. (This is in addition to generating the signing public key and adding it to the user's local keyring-for-public-keys as mentioned above.) This is a labour-saving feature: assuming that you would otherwise generate a revocation certificate manually, if creating a new private keyring, it spares you from having to do that.