Managing multiple GPG keys

Question

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. I'd like to put a different GPG key on each so I can revoke a single key at a time in the event of a key loss. The plan is backup those private keys on usb drives off site as well. All pretty straight forward. (these keys are used as ssh keys for servers, github, commit signing, and the odd file encryption).

I'd like to know if I can use the GPG "web of trust" to sign one "master master" key and assign transitive trust to all of my yubikeys at once. As I understand it, this should be possible, but I don't think this property will apply to any SSH keys I export, nor do I understand if/how github would mark the sub gpg keys used for signing.

Answer 1

gpg trust only works within the gpg ecosystem. SSH is not a part of the gpg ecosystem. The use of a gpg key for ssh is only an overlap of the key algorithms (private/public key raw material). The gpg implementation of the ssh agent interface makes it easy to use, or you can export, but you will notice you must export into the ssh format, not the same as gpg exported to text.

SSH has its own proprietary signing (trust) mechanisms which enable signed ssh keys. They do not translate to gpg’s proprietary signing (trust) framework or mechanisms.