I've created a keypair with

gpg2 --gen-key

Then I created a subkey only for signing.

If I clearly understand the process I have now 3 pub/priv pairs. The master, one for encrypting and one for signing.

I exported public keys with:

gpg --armor --export FINGERPRINT > pub.asc

Now I have a file which seems to contain only one public key. Is it the master public key? Does this pub key contain the others public keys?

I'll sign with the third subkey I've created, so which public key do I need to upload on a keyserver?


1 Answer 1


Subkeys are bound to the primary key and exported together with it when calling gpg --export or gpg --send-keys. Same applies to signatures and user ID packages.

  • Does this mean that the message will be encrypted once for each subkey, or that every subkey is able to decrypt a message encrypted for the original public key?
    – lucidbrot
    Nov 6, 2017 at 7:59
  • 1
    Neither of those; usually, GnuPG will encrypt for the newest valid subkey. Only this subkey will be able to decrypt the message.
    – Jens Erat
    Nov 17, 2017 at 20:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .