First of all, is my understanding correct that primary keys and subkeys are all key pairs consisting of a private and a public key?
I get the rationale behind using primary keys and subkeys1, and why one should keep the private primary key (or master key) "very, very safe", but not sure what the consensus is on handling the public primary key? Is this the one that should be shared with others or uploaded to a key server2? (Sometimes this may be an explicit requirement.)
It was also confusing to see sentences such as "GnuPG actually uses a signing-only key as the master key" but realized that this refers to the private primary key because (quoting from the same source)
You use the private key to digitally sign files, and others use the public key to verify the signature. Or, others use the public key to encrypt something, and you use the private key to decrypt it.
- To use different keys for signing and encrypting
- to mitigate the effect of lost/stolen keys (see also)
- (TODO: continue list with more)
: Superuser thread: Where to upload PGP public key? Are KeyServers still surviving?