I'm a little bit confused here, since the best practice suggests that main key should be completely offline, so which key should I upload to the public directory?

Here's what I have:

  • main key (sign only)
  • subkey#1 (sign)
  • subkey#2 (encryption)
  • subkey#3 (authentication).

1 Answer 1


The best practices are to keep your primary private key offline. Your public key is required to be available, as all subkeys, user IDs (and thus certifications) are bound to it.

As you do not upload private keys to key servers anyway, you do not have to care about offline keys at all. You have to upload the primary public key, but could choose from the subkeys (depending on which you want to be available).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.