I understand the benefits of using subkeys. I also know that, in the case of private keys it is possible to detach the subkeys from the master key, since there are times when a user may prefer not to store the private master key with the private subkeys. (Using gpg, --export-secret-subkeys
)
Moreover, when you do --export
a public key, it appears not to matter whether you use the fingerprint of the master key or that of one of the subkeys.
As far as I can tell, it's not possible to detach public subkeys. Let me be clear: I can't think of any significant reason why one would wish to. The only rationale I can think of is minimalist - you might want to only import the public subkeys because that's all that you intend to use. But I am trying to figure out whether there is a more fundamental reason.
- Is it because the user id details are attached to the master key, and detaching subkeys would allow unidentified keys to float around? (I'm not convinced by this - when you import detached private subkeys, the absent master key still gets a reference [sec# etc.], even when it is absent. So surely the same could be done for public keys.)
- Is it just because there is no good reason for doing so?
If, however, there is some reason public subkeys can't logically be split from the public master key, that would suggest I don't properly understand subkeys.